Fedora Update for xen FEDORA-2012-17408

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CVE-2012-4850

IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1, when JAX-RS is used, does not properly validate requests, which allows remote attackers to gain privileges via unspecified vectors...

CVE-2012-3569

Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and other products, allows user-assisted remote attackers to execute arbitrary code via a crafted OVF file...

CVE-2012-5459

Untrusted search path vulnerability in VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows allows host OS users to gain host OS privileges via a Trojan horse DLL in a "system folder."...

CVE-2012-4850

CVE-2012-4850 – IBM WebSphere Application Server Liberty Profile : In versions before 8.5.0.1, when using JAX-RS, requests are not properly validated, allowing remote attackers to gain elevated privileges. The issue is documented in the IBM WebSphere security bulletin and linked advisories, with ...

CVE-2012-4851

CVE-2012-4851 affects IBM WebSphere Application Server Liberty Profile (8.5) with versions before 8.5.0.1. The issue is a cross-site scripting (XSS) vulnerability that lets remote attackers inject arbitrary web script or HTML via a crafted URI. The related connected IBM bulletin entries describe ...

CVE-2012-4953

CVE-2012-4953 affects the legacy Symantec decomposer engine used by multiple products and versions: SEP 11.0, SEP SBE 12.0, SAVCE 10.x, and SSE before 5.2.8. The issue is improper bounds checking when parsing CAB archive contents, potentially allowing a remote attacker to crash the application or...

CVE-2012-5459

CVE-2012-5459; VMware Workstation 8.x (<8.0.5) and VMware Player 4.x (

CVE-2012-4847

CVE-2012-4847 affects IBM Cognos BI 8.4 and 8.4.1. A remote authenticated user can cause high CPU usage via a crafted request containing a zero-valued byte, yielding a partial denial of service. According to IBM, exploitation requires authentication and it does not apply to Cognos BI 10.1 and lat...

CVE-2012-4948

CVE-2012-4948 describes a default-configuration issue in Fortinet Fortigate UTM appliances: the same Fortigate CA certificate and private key are reused across devices, enabling an attacker with a man-in-the-middle vantage point to spoof SSL servers or sign malware on trusted chains. The CERT/CSA...

CVE-2012-2619

The CVE-2012-2619 entry concerns a flaw in Broadcom BCM4325/ BCM4329 Wi‑Fi firmware that handles 802.11i information elements. An out-of-bounds read could be triggered by a remote attacker on the same Wi‑Fi network, potentially causing a Wi‑Fi outage or device instability. Apple TV advisories cor...

CVE-2012-4853

CVE-2012-4853 describes a cross-site request forgery (CSRF) in IBM WebSphere Application Server. Affected versions are 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1. The vulnerability could allow an attacker to hijack the authentication of a user for request...

CVE-2012-3330

CVE-2012-3330 affects IBM WebSphere Application Server and WebSphere Virtual Enterprise. The DoS arises from an error in the proxy server component: a crafted request can cause the daemon to outage. Affected versions include WebSphere Application Server 7.0 prior to 7.0.0.27, 8.0 prior to 8.0.0.5...

CVE-2012-5458

Summary (CVE-2012-5458) VMware Workstation 8.x (pre-8.0.5) and VMware Player 4.x (pre-4.0.5) on Windows are affected by a flaw where certain created host process threads have weak permissions. This weak permission set can allow a local attacker with access to the host OS to escalate privileges on...

CVE-2012-4949

CVE-2012-4949 is an SQL injection vulnerability in ESRI ArcGIS 10.1 where the where parameter in a REST service query URI can be exploited by remote authenticated users to execute arbitrary SQL. The root cause is inadequate sanitization of SQL commands in the where clause, enabling a subset of SQ...

CVE-2012-3569

CVE-2012-3569 is a format-string vulnerability in VMware OVF Tool 2.1 on Windows (affecting VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and related products). The flaw arises during OVF file parsing, enabling a attacker to achieve arbitrary code execution via a crafted OV...

flash-player: Update to 11.2.202.251 (important)

Flash Player was updated to 11.2.202.251 bnc788450, fixing severe security issues: CVE-2012-5274, CVE-2012-5275, CVE-2012-5276, CVE-2012-5277, CVE-2012-5278, CVE-2012-5279, CVE-2012-5280...

CVE-2012-1885

Heap-based buffer overflow in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Office 2008 and 2011 for Mac; and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel SerAuxErrBar Heap Overflow Vulnerability."...

CVE-2012-1539

Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CTreePos Use After Free Vulnerability."...

CVE-2012-2543

Stack-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 SP1; Office 2011 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Stack Overflow Vulnerability."...