CVE-2013-1336

The Common Language Runtime CLR in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check signatures, which allows remote attackers to make undetected changes to signed XML documents via unspecified vectors that preserve signature validity, aka "XML Digital Signature...

Microsoft .NET Framework XML Digital Signature CVE-2013-1336 Security Bypass Vulnerability

Description Microsoft .NET Framework is prone to a security-bypass vulnerability because it fails to properly validate the signature of a specially crafted XML file. Attackers can exploit this issue to bypass XML digital signature validation and spoof XML content by conducting man-in-the-middle...

Microsoft .NET XML Digital Signature Spoofing (MS13-040; CVE-2013-1336)

A spoofing vulnerability has been reported when the Microsoft .NET Framework fails to properly validate the signature of specially crafted XML files. Successful exploitation would allow an attacker to modify the contents of an XML file without invalidating the signature associated with the file...

[waraxe-2013-SA#100] - Update Spoofing Vulnerability in mRemote 1.50

waraxe-2013-SA100 - Update Spoofing Vulnerability in mRemote 1.50 =============================================================================== Author: Janek Vind "waraxe" Date: 29. March 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-100.html Description of vulnerable softwar...

Threat Outbreak Alert: Fake Remittance Slip with Invalid Digital Signature Email Messages on July 5, 2013

Medium Alert ID: 28919 First Published: 2013 April 11 14:36 GMT Last Updated: 2013 July 5 17:33 GMT Version: 6 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a remittance slip attachment for the recipient. The text in the email messag...

mRemote 1.50 Update Spoofing Vulnerability

mRemote version 1.50 suffers from an update spoofing vulnerability. Update Spoofing Vulnerability in mRemote 1.50 =============================================================================== Author: Janek Vind "waraxe" Date: 29. March 2013 Location: Estonia, Tartu Web:...

mRemote 1.50 Update Spoofing

waraxe-2013-SA100 - Update Spoofing Vulnerability in mRemote 1.50 =============================================================================== Author: Janek Vind "waraxe" Date: 29. March 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-100.html Description of vulnerable softwar...

LibreOffice update spoofing

Updates are checked via insecure connection, digital signature is not validated...

[waraxe-2013-SA#099] - Update Spoofing Vulnerability in LibreOffice 4.0.1.2

waraxe-2013-SA099 - Update Spoofing Vulnerability in LibreOffice 4.0.1.2 =============================================================================== Author: Janek Vind "waraxe" Date: 21. March 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-99.html Description of vulnerable...

Ubuntu 10.10 : openjdk-6b18 vulnerabilities (USN-1079-3)

USN-1079-2 fixed vulnerabilities in OpenJDK 6 for armel ARM architectures in Ubuntu 9.10 and Ubuntu 10.04 LTS. This update fixes vulnerabilities in OpenJDK 6 for armel ARM architectures for Ubuntu 10.10. It was discovered that untrusted Java applets could create domain name resolution cache...

Ubuntu 9.10 / 10.04 LTS : openjdk-6b18 vulnerabilities (USN-1079-2)

USN-1079-1 fixed vulnerabilities in OpenJDK 6 for non-armel ARM architectures. This update provides the corresponding updates for OpenJDK 6 for use with the armel ARM architectures. In order to build the armel ARM OpenJDK 6 update for Ubuntu 10.04 LTS, it was necessary to rebuild binutils and...

Sun Java JRE Multiple Vulnerabilities (263408 / 263409 / 263428 ..) (Unix)

The version of Sun Java Runtime Environment JRE installed on the remote host is earlier than 6 Update 15 / 5.0 Update 20 / 1.4.222 / 1.3.126. Such version are potentially affected by the following security issues : - A vulnerability in the JRE audio system may allow system properties to be...

Sun Java JRE Multiple Vulnerabilities (244986 et al) (Unix)

The version of Sun Java Runtime Environment JRE installed on the remote host is earlier than 6 Update 11 / 5.0 Update 17 / 1.4.219 / 1.3.124. Such versions are potentially affected by the following security issues : - The JRE creates temporary files with insufficiently random names. 244986 - Ther...

Android application lazy listen to the book the automatic updates can be exploited-vulnerability warning-the black bar safety net

Brief description: www.yytingting.com 出品 的 Android 有声读物 软件“lazy listen to the book”, in the automatic update when the verification is insufficient, may be utilized to replace other apk, and ultimately can achieve remote code execution. Detailed description: www.yytingting.com 出品 的 Android 有声读物...

Six Security Flaws Fixed in BIND 9.9.2

A new version of the BIND DNS server software is available, fixing six security vulnerabilities and a long list of other bugs. BIND 9.9.2-P1 is mainly a security update and most of the issues it fixes are crashes and not remote code execution flaws. BIND is the overwhelming leader in market share...

Oberthur smart cards generate weak certificates

Overview A flaw has been identified in Oberthur ID-One COSMO 64, v5.2 and v5.2a smart cards, which results in public keys that do not satisfy the requirements of the Digital Signature Standard as specified in FIPS PUB 186-3 and its predecessors. Description Oberthur ID-One COSMO 64, v5.2 and v5.2...

Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64

The jdk in Scientific Linux 4 and 5 is being updated from 1.5.0 to 1.6.0. This update provides some security updates, as well as several feature updates. Java code that was able to run on version 1.5.0 should be able run on the 1.6.0 version. It is recommended that you recompiled your java code o...

Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x i386/x86_64

A flaw was found in the Swing library. Forged TimerEvents could be used to bypass SecurityManager checks, allowing access to otherwise blocked files and directories. CVE-2010-4465 A flaw was found in the HotSpot component in OpenJDK. Certain bytecode instructions confused the memory management...

CentOS Update for xmlsec1 CESA-2011:0486 centos4 x86_64

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for xmlsec1 CESA-2011:0486 centos4 x86_64

Check for the Version of xmlsec1 OpenVAS Vulnerability Test CentOS Update for xmlsec1 CESA-2011:0486 centos4 x8664 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...