Code injection

The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-3188

The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-3188

The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-3188

The CVE-2015-3188 issue affects Apache Storm UI daemon: Storm 0.10.0-beta (before 0.10.0-beta1) allows remote attackers to execute arbitrary code via unspecified vectors. The root cause is the UI daemon handling requests in a way that permits code execution when exposed to unauthenticated/remote ...

ISC BIND 9 RTYPE ANY Assertion Failure Denial of Service Vulnerability

ISC BIND is a suite of open source software that implements the DNS protocol. ISC BIND 9 Supported Preview Edition is a preview edition. ISC BIND 9 suffers from a RTYPE ANY assertion failure denial of service vulnerability. A remote attacker can exploit the vulnerability to cause a denial of...

docker-engine docker-engine-selinux security and bugfix update

1.12.6-1.0.1 - Enable configuration of Docker daemon via sysconfig orabug 21804877 - Require UEK4 for docker 1.9 orabug 22235639 22235645 - Add docker.conf for prelink orabug 25147708 1.12.6 - the systemd unit file /usr/lib/systemd/system/docker.service contains local changes, or - a systemd...

CVE-2016-9444

named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service assertion failure and daemon exit via a crafted DS resource record in an answer...

CVE-2016-9444

CVE-2016-9444 affects ISC BIND 9.x; a crafted DS resource record in an answer can cause the named DNS server to crash via an assertion failure, if the BIND recursion option is enabled. The vulnerability is exploited remotely by an unauthenticated attacker and may cause the named process to exit (...

Network Time Protocol Windows Daemon getEndptFromIoCtx Denial of Service (CVE-2016-9312)

A denial of service vulnerability has been reported in the Windows port of Network Time Foundation's NTP Daemon. The vulnerability is due to insufficient error handling when receiving large UDP packets. A remote, unauthenticated attacker can exploit this vulnerability by sending a large UDP packe...

OpenSSH 7.x < 7.4 Multiple Vulnerabilities

Binary data 9855.prm...

Integer overflow

An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to ...

CVE-2016-10030

CVE-2016-10030 affects Slurm: the Prolog failure handling in slurmd/req.c can let a user influence an arbitrary file if they can cause or anticipate a Prolog script failure on a compute node. Affected versions span Slurm up to present in 0.6.0 onwards, with fixed ranges listed as: before 15.08.13...

DEBIAN-CVE-2016-10011

authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process...

UBUNTU-CVE-2016-10011

authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process...

CVE-2016-10010

sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Use-After-Free Vulnerability in pcsc-lite

Peter Wu on Openwall mailing-list reports: The issue allows a local attacker to cause a Denial of Service, but can potentially result in Privilege Escalation since the daemon is running as root. while any local user can connect to the Unix socket. Fixed by patch which is released with hpcsc-lite...

[SECURITY] Fedora 24 Update: xen-4.6.4-5.fc24

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

mod_wsgi: Privilege escalation

Background modwsgi is an Apache2 module for running Python WSGI applications. Description modwsgi, when creating a daemon process group, does not properly handle dropping group privileges. Impact Context-dependent attackers could escalate privileges due to the improper handling of group privilege...

[SECURITY] Fedora 25 Update: community-mysql-5.7.17-1.fc25

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon mysqld and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files...