curl: incorrect handle duplication after COPYPOSTFIELDS

A flaw was found in the way the libcurl library performed the duplication of connection handles. If an application set the CURLOPTCOPYPOSTFIELDS option for a handle, using the handle's duplicate could cause the application to crash or disclose a portion of its memory...

Multiple IBM Tivoli Storage Products Information Disclosure Vulnerabilities

IBM Tivoli Storage FlashCopy Manager for Microsoft Exchange Server and others are products of IBM Corporation, USA.Tivoli Storage FlashCopy Manager for Microsoft Exchange Server is a suite of solution for advanced data protection for critical applications and databases in e-mail servers running...

curl, libcurl security update

CentOS Errata and Security Advisory CESA-2015:1254 Updated curl packages that fix multiple security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common...

curl: incorrect handle duplication after COPYPOSTFIELDS

A flaw was found in the way the libcurl library performed the duplication of connection handles. If an application set the CURLOPTCOPYPOSTFIELDS option for a handle, using the handle's duplicate could cause the application to crash or disclose a portion of its memory...

UBUNTU-CVE-2014-9403

The CWebAdminMod::ChanPage function in modules/webadmin.cpp in ZNC before 1.4 allows remote authenticated users to cause a denial of service NULL pointer dereference and crash by adding a channel with the same name as an existing channel but without the leading character, related to a...

UBUNTU-CVE-2014-3687

The sctpassoclookupasconfack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service panic via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter...

duphandle read out of bounds

libcurl's function curleasyduphandle has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending. When doing an HTTP POST transfer with libcurl, you can use the CURLOPTCOPYPOSTFIELDS option to specify a memory area holding the data to send to the...

wireshark: RTP dissector crash (wnpa-sec-2014-12)

The SDP dissector in Wireshark 1.10.x before 1.10.10 creates duplicate hashtables for a media channel, which allows remote attackers to cause a denial of service application crash via a crafted packet to the RTP dissector...

libjpeg: information leak (read of uninitialized memory)

The getsos function in jdmarker.c in 1 libjpeg 6b and 2 libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan SOS JPEG markers,...

CVE-2014-3540

CVE-2014-3540 is a duplicate of CVE-2014-0114. The connected advisories describe a remote code execution flaw in Apache Struts 1.x (1.x through 1.3.10) where an attacker can manipulate the ClassLoader via the class parameter passed to getClass, enabling arbitrary code execution. Remediation cente...

CRYPTOCard CRYPTOAdmin 4.1 Weak Encryption Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/1097/info CRYPTOCard CRYPTOAdmin is a network authentication application for use with the Palm OS platform. CRYPTOAdmin generates a .pdb file which contains the username, PIN number, serial number, and key in encrypted or...

CVE-2014-2750

CVE-2014-2750 entry is rejected/not used and does not represent an active vulnerability.

UBUNTU-CVE-2014-2673

The archduptaskstruct function in the Transactional Memory TM implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platform does not properly interact with the clone and fork system calls, which allows local users to cause a denial of service Program...

CVE-2013-6405

CVE-2013-6405 is rejected/not used and does not represent an active vulnerability entry.

libjpeg: information leak (read of uninitialized memory)

The getsos function in jdmarker.c in 1 libjpeg 6b and 2 libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan SOS JPEG markers,...

L3 CPU shared cache architecture is susceptible to a Flush+Reload side-channel attack

Overview L3 CPU shared cache architecture is susceptible to a Flush+Reload side-channel attack, resulting in information leakage. allowing a local attacker to derive the contents of memory not belonging to the attacker. Description Common L3 CPU shared cache architecture is susceptible to a...

CVE-2013-4266

CVE-2013-5123 affects Python pip prior to 1.5, where the mirroring support (-M, --use-mirrors) performs insecure DNS querying and lacks proper authentication checks, enabling potential man-in-the-middle attacks to download software over insecure links. Multiple connected sources (NVD entries and ...

[360-FAAR v0.4.1] Firewall Analysis Audit And Repair

360-FAAR Firewall Analysis Audit and Repair is an offline, command line, Perl firewall policy manipulation tool to filter, compare to logs, merge, translate and output firewall commands for new policies, in Checkpoint dbedit, Cisco ASA or ScreenOS commands, and its one file! Changes: This release...

CVE-2012-6138

CVE-2012-6138 is rejected and not used; refer to duplicate CVEs (e.g., CVE-2012-6536..6549).

CVE-2012-5593

Wireshark 1.8.x before 1.8.4 is affected by CVE-2012-5593 (USB dissector DoS). The USB dissector in epan/dissectors/packet-usb.c can loop indefinitely when processing crafted data, leading to denial of service. Vendors openSUSE SUSE-SU-2013:0238-1 and openSUSE/SUSE advisories list CVE-2012-5593 a...