Debian DSA-2518-1 : krb5 - denial of service and remote code execution

Emmanuel Bouillon from NCI Agency discovered multiple vulnerabilities in MIT Kerberos, a daemon implementing the network authentication protocol. - CVE-2012-1014 By sending specially crafted AS-REQ Authentication Service Request to a KDC Key Distribution Center, an attacker could make it free an...

CVE-2012-1015

The kdchandleprotectednegotiation function in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.8.x, 1.9.x before 1.9.5, and 1.10.x before 1.10.3 attempts to calculate a checksum before verifying that the key type is appropriate for a checksum, which allows remote attackers to execute...

CVE-2012-1014

The processasreq function in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.10.x before 1.10.3 does not initialize a certain structure member, which allows remote attackers to cause a denial of service uninitialized pointer dereference and daemon crash or possibly execute arbitrary...

CentOS Update for krb5-devel CESA-2011:0199 centos5 x86_64

Check for the Version of krb5-devel OpenVAS Vulnerability Test CentOS Update for krb5-devel CESA-2011:0199 centos5 x8664 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modi...

Debian DSA-2508-1 : kfreebsd-8 - privilege escalation

Rafal Wojtczuk from Bromium discovered that FreeBSD wasn't handling correctly uncanonical return addresses on Intel amd64 CPUs, allowing privilege escalation to kernel for local users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

DSA-2515-1 nsd3 - null pointer dereference

Bulletin has no description...

CVE-2012-0794

The rc4encrypt function in lib/moodlelib.php in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 uses a hardcoded password of nfgjeingjk, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by reading this script's...

CVE-2012-0794

The CVE-2012-0794 issue affects Moodle 1.9.x up to 1.9.15, 2.0.x up to 2.0.6, 2.1.x up to 2.1.3, and 2.2.x up to 2.2.0, where rc4encrypt in lib/moodlelib.php uses a hardcoded password (nfgjeingjk). This weak cryptographic protection can be defeated by reading the script’s source code within the d...

A domain name is a virtual host distribution management system 0day-vulnerability warning-the black bar safety net

google search: inurl:help/notice. asp? nid= Placed directly into the injection tool is injected directly can wait until the DBOWNER Background setinmanager...

RedHat Update for krb5 RHSA-2011:1790-01

Check for the Version of krb5 OpenVAS Vulnerability Test RedHat Update for krb5 RHSA-2011:1790-01 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...

DSA-2509-1 pidgin - remote code execution

Bulletin has no description...

Debian DSA-2506-1 : libapache-mod-security - ModSecurity bypass

Qualys Vulnerability & Malware Research Labs discovered a vulnerability in ModSecurity, a security module for the Apache webserver. In situations where both 'Content:Disposition: attachment' and 'Content-Type: multipart' were present in HTTP headers, the vulnerability could allow an attacker to...

Debian DSA-2494-1 : ffmpeg - several vulnerabilities

It was discovered that FFmpeg, Debian's version of the Libav media codec suite, contains vulnerabilities in the DPCM codecs CVE-2011-3951 , H.264 CVE-2012-0851 , ADPCM CVE-2012-0852 , and the KMVC decoder CVE-2011-3952 . In addition, this update contains bug fixes from the Libav 0.5.9 upstream...

DSA-2505-1 zendframework - information disclosure

Bulletin has no description...

Debian DSA-2486-1 : bind9 - denial of service

It was discovered that BIND, a DNS server, can crash while processing resource records containing no data bytes. Both authoritative servers and resolvers are affected. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

[SECURITY] [DSA 2500-1] mantis security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2500-1 [email protected] http://www.debian.org/security/ Florian Weimer June 24, 2012 http://www.debian.org/security/faq -...

DSA-2498-1 dhcpcd - remote stack overflow

Bulletin has no description...

[BSA-074] Security update for libreoffice

Rene Engelhard uploaded new packages for libreoffice which fixed the following security problem: CVE-2012-1149 Integer overflows in PNG image handling For the squeeze-backports distribution the problems have been fixed in version 1:3.4.6-2bpo60+2...

DSA-2491-1 postgresql-8.4 - several

Bulletin has no description...

How The Flame Malware Stayed Hidden For So Long

The past week has brought to light more revelations about the mysterious Flame or sKyWIper worm that was first identified at the end of May. Among them: the eye-popping admission from Microsoft that the malware’s authors found a way to use that company’s Windows Update feature to distribute the...