CVE-2014-3583

The handleheaders function in modproxyfcgi.c in the modproxyfcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service buffer over-read and daemon crash via long response headers...

CVE-2014-6053

The CVE-2014-6053 issue affects LibVNCServer up to version 0.9.9, where rfbProcessClientNormalMessage does not properly handle large ClientCutText data, enabling a remote attacker to cause a denial of service via a crafted message processed by a single unchecked malloc. Connected sources (Astra L...

UBUNTU-CVE-2014-3583

The handleheaders function in modproxyfcgi.c in the modproxyfcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service buffer over-read and daemon crash via long response headers...

Debian DSA-3099-1 : dbus - security update

Simon McVittie discovered that the fix for CVE-2014-3636 was incorrect, as it did not fully address the underlying denial-of-service vector. This update starts the D-Bus daemon as root initially, so that it can properly raise its file descriptor count. In addition, this update reverts the...

GNUstep Base library: Denial of service

Background GNUstep Base library is a free software package implementing the API of the OpenStep Foundation Kit tm, including later additions. Description GNUstep Base library does not properly handle the file descriptor for logging, when run as a daemon. Impact A remote attacker could send a...

Code injection

IBM DB2 9.5 through FP10, 9.7 through FP10, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP5 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service daemon crash by specifying an identity column within a crafted ALTER TABLE statement...

DEBIAN-CVE-2013-4399

The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes event handler removal to be denied and remote attackers to cause a denial of service use-after-free and crash by registering an event handler and then closing t...

[SECURITY] Fedora 19 Update: xen-4.2.5-6.fc19

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

[SECURITY] Fedora 20 Update: xen-4.3.3-6.fc20

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

[SECURITY] Fedora 21 Update: xen-4.4.1-9.fc21

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

[slackware-security] openssh

New openssh packages are available for Slackware 14.0, 14.1, and -current. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/openssh-6.7p1-i486-2slack14.1.txz: Rebuilt. Restored support for tcpwrappers that was dropped by upstream. Thanks to mancha. Where to find the new...

Debian Security Advisory DSA 3099-1 (dbus - security update)

Simon McVittie discovered that the fix for CVE-2014-3636 was incorrect, as it did not fully address the underlying denial-of-service vector. This update starts the D-Bus daemon as root initially, so that it can properly raise its file descriptor count. In addition, this update reverts the...

Updated apache-mod_wsgi package fixes security vulnerability

It was discovered that modwsgi incorrectly handled errors when setting up the working directory and group access rights. A malicious application could possibly use this issue to cause a local privilege escalation when using daemon mode CVE-2014-8583...

Ubuntu 14.04 LTS : MAAS regression (USN-2431-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2431-2 advisory. USN-2431-1 fixed vulnerabilities in modwsgi. The security update exposed an issue in the MAAS package, causing a regression. This update fixes the problem. We...

USN-2431-2 maas regression

USN-2431-1 fixed vulnerabilities in modwsgi. The security update exposed an issue in the MAAS package, causing a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that modwsgi incorrectly handled errors when setting up the...

Ubuntu 14.04 LTS : mod_wsgi vulnerability (USN-2431-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2431-1 advisory. It was discovered that modwsgi incorrectly handled errors when setting up the working directory and group access rights. A malicious application could possibly us...

hostapd: wpa_cli and hostapd_cli remote command execution issue

A command injection flaw was found in the way the wpacli utility executed action scripts. If wpacli was run in daemon mode to execute an action script specified using the -a command line option, and wpasupplicant was configured to connect to a P2P group, malicious P2P group parameters could cause...

USN-2431-1 mod-wsgi vulnerability

It was discovered that modwsgi incorrectly handled errors when setting up the working directory and group access rights. A malicious application could possibly use this issue to cause a local privilege escalation when using daemon mode...

SOL15889 - Apache HTTP server vulnerabilities CVE-2011-3368, CVE-2011-4317, CVE-2012-0021, CVE-2012-0031, and CVE-2012-0053

CVE-2011-3368 The modproxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of 1 RewriteRule and 2 ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send...

Important: Red Hat Security Advisory: mariadb-galera security update

Updated mariadb-galera packages that fix multiple security issues are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 on Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...