UEFI firmware image viewer and editor: UEFITool

It supports parsing of full BIOS images starting with the flash descriptor or any binary files containing UEFI volumes. Original development was started here at MDL forums as a cross-platform analog to PhoenixTool ‘s structure mode with some additional features, but the program’s engine was prove...

asterisk -- Multiple vulnerabilities

The Asterisk project reports: AST-2016-001 - BEAST vulnerability in HTTP server AST-2016-002 - File descriptor exhaustion in chansip AST-2016-003 - Remote crash vulnerability when receiving UDPTL FAX data...

Apple Mac OSX - 'IOHDIXControllerUserClient::convertClient' Buffer Integer Overflow

/ Source: https://code.google.com/p/google-security-research/issues/detail?id=511 Method 5 of the IOHDIXController user client is createDrive64. This takes a 0x100 byte structure input from which it reads a userspace pointer and a size which it passes to IOHDIXController::convertClientBuffer. Thi...

FreeBSD : privoxy -- multiple vulnerabilities (89d4ed09-c3d7-11e5-b5fe-002590263bf5)

Privoxy Developers reports : Fixed a memory leak when rejecting client connections due to the socket limit being reached CID 66382. This affected Privoxy 3.0.21 when compiled with IPv6 support on most platforms this is the default. Fixed an immediate-use-after-free bug CID 66394 and two additiona...

UBUNTU-CVE-2016-1981

QEMU aka Quick Emulator built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head TDH/RDH is set outside the allocated descriptor buffer. A...

OpenSSH 'roaming_read' and 'roaming_write' function denial of service vulnerability

OpenSSH is a set of connection tools maintained by the OpenBSD Project Group for secure access to remote computers. The 'roamingread' and 'roamingwrite' functions in the roamingcommon.c file in OpenSSH's client, when, with specific proxy and forwarding options enabled, the Failure to properly...

CVE-2016-0778

The 1 roamingread and 2 roamingwrite functions in roamingcommon.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service heap-based...

openssh: multiple issues

CVE-2016-0777 information disclosure An information leak flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to leak portions of memory possibly including private SSH keys of a successfully authenticated OpenSSH client...

FreeBSD : qemu -- denial of service vulnerability in USB EHCI emulation support (60cb2055-b1b8-11e5-9728-002590263bf5)

Prasad J Pandit, Red Hat Product Security Team, reports : Qemu emulator built with the USB EHCI emulation support is vulnerable to an infinite loop issue. It occurs during communication between host controller interfaceEHCI and a respective device driver. These two communicate via a isochronous...

Scientific Linux Security Update : libssh2 on SL7.x x86_64 (20151119)

A flaw was found in the way the kexagreemethods function of libssh2 performed a key exchange when negotiating a new SSH session. A man-in-the- middle attacker could use a crafted SSHMSGKEXINIT packet to crash a connecting libssh2 client. CVE-2015-1782 This update also fixes the following bugs : -...

[SECURITY] Fedora 23 Update: libtevent-0.9.26-1.fc23

Tevent is an event system based on the talloc memory management library. Tevent has support for many event types, including timers, signals, and the classic file descriptor events. Tevent also provide helpers to deal with asynchronous code providing the teventreq Tevent Request functions...

UBUNTU-CVE-2015-8558

The ehciprocessitd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service infinite loop and CPU consumption via a circular isochronous transfer descriptor iTD list...

qemu -- denial of service vulnerability in USB EHCI emulation support

Prasad J Pandit, Red Hat Product Security Team, reports: Qemu emulator built with the USB EHCI emulation support is vulnerable to an infinite loop issue. It occurs during communication between host controller interfaceEHCI and a respective device driver. These two communicate via a isochronous...

SUSE-SU-2015:2167-1 Security update for kernel-source-rt

The SUSE Linux Enterprise 11 SP4 Realtime kernel was updated to version 3.0.101.rt130-45.1 to receive various security and bugfixes. Following security bugs were fixed: CVE-2015-6252: Possible file descriptor leak for each VHOSTSETLOGFDcommand issued, this could eventually wasting available syste...

CentOS 7 : libssh2 (CESA-2015:2140)

Updated libssh2 packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

glibc security, bug fix, and enhancement update

2.17-105.0.1 - Remove strstr and strcasestr implementations using sse4.2 instructions. - Upstream commits 584b18eb4df61ccd447db2dfe8c8a7901f8c8598 and 1818483b15d22016b0eae41d37ee91cc87b37510 backported. 2.17-105 - Fix up test case for initial-exec fix 1248208. 2.17-104 - Mark all TLS variables i...

latex2rtf Formatted String Denial of Service Vulnerability

latex2rtf is a converter for converting LaTeX documents to RTF format. The latex2rtf formatted-printing function fails to adequately filter user input that is used as a formatting descriptor, allowing an attacker to exploit the vulnerability to construct a malicious file that can be parsed by...

Low: Red Hat Security Advisory: libssh2 security and bug fix update

Updated libssh2 packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Red Hat Enterprise Linux kernel usbvision driver denial of service vulnerability

Red Hat Enterprise Linux RHEL is a Linux operating system for business users maintained and distributed by Red Hat, Inc. The Linux kernel is the kernel used by the operating system and is distributed by the Linux Foundation. A security vulnerability exists in the usbvision driver in the Linux...

USN-2777-1 linux-lts-utopic vulnerabilities

It was discovered that virtio networking in the Linux kernel did not handle fragments correctly, leading to kernel memory corruption. A remote attacker could use this to cause a denial of service system crash or possibly execute code with administrative privileges. CVE-2015-5156 Benjamin Randazzo...