Microsoft Warns of New IE Zero Day

UPDATE–Microsoft is looking into reports of targeted attacks against a new vulnerability that exists in all supported versions of Internet Explorer. The attacks are targeting IE 8 and 9 and there’s no patch for the vulnerability right now, though Microsoft has developed a FixIt tool for it. “The...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2044)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-2044 advisory. - hugepages: fix use after free bug in 'quota' handling 15842385 CVE-2012-2133 - mm: Hold a file reference in madviseremove 15842884 CVE-2012-3511 ...

Oracle Linux 6 : kernel (ELSA-2012-1426)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1426 advisory. - mm hugetlb: do not use vmahugecacheoffset for vmapriotreeforeach Frederic Weisbecker 843034 843035 CVE-2012-2133 - mm hugepages: fix use after free b...

RHEL 6 : kernel (RHSA-2013:0741)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0741 advisory. - kernel: use after free bug in quota handling CVE-2012-2133 - kernel: race condition with PTRACESETREGS CVE-2013-0871 Note that Nessus has...

Debian DSA-2469-1 : linux-2.6 - privilege escalation/denial of service

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-4086 Eric Sandeen reported an issue in the journaling layer for ext4...

CentOS Update for kernel CESA-2009:1670 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

openSUSE Security Update : libopenssl-devel (openSUSE-SU-2010:0952-1)

Specially crafted responses from SSL servers could cause a double-free bug in openssl's client implementation. Malicious servers could exploit that to crash programs use openssl for the SSL connection CVE-2010-2939. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

openSUSE Security Update : libopenssl-devel (openSUSE-SU-2010:0951-1)

Specially crafted responses from SSL servers could cause a double-free bug in openssl's client implementation. Malicious servers could exploit that to crash programs use openssl for the SSL connection CVE-2010-2939. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

SuSE 11 / 11.1 Security Update : OpenSSL (SAT Patch Numbers 3208 / 3209)

Specially crafted responses from SSL servers could cause a double-free bug in openssl's client implementation. Malicious servers could exploit that to crash programs use openssl for the SSL connection CVE-2010-2939. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7174)

Specially crafted responses from SSL servers could cause a double-free bug in openssl's client implementation. Malicious servers could exploit that to crash programs use openssl for the SSL connection CVE-2010-2939. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The tex...

GLSA-200803-28 : OpenLDAP: Denial of Service vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200803-28 OpenLDAP: Denial of Service vulnerabilities The following errors have been discovered in OpenLDAP: Tony Blake discovered an error which exists within the normalisation of 'objectClasses' CVE-2007-5707. Thomas Sesselmann...

openSUSE 10 Security Update : libxfcegui4 (libxfcegui4-4890)

A possible double-free bug has been fixed, in case the application free's the passed data arguments. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update libxfcegui4-4890. The text description of...

openSUSE 10 Security Update : krb5 (krb5-3045)

A bug in the function krb5klogsyslog leads to a buffer overflow which could be exploited to execute arbitrary code CVE-2007-0957. A double-free bug in the GSS-API library could crash kadmind. It's potentially also exploitable to execute arbitrary code CVE-2007-1216. %NASLMINLEVEL 70300 C Tenable...

DEBIAN-CVE-2005-0891

Double free vulnerability in gtk 2 gtk2 before 2.2.4 allows remote attackers to cause a denial of service crash via a crafted BMP image...

Important: Red Hat Security Advisory: php security update

Updated php packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A double-free bug was found in the deserialization code of PHP. PHP applications use the unserialize...

RHEL 2.1 : php (RHSA-2005:031)

Updated php packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A double-free bug was found in the deserialization code of PHP. PHP applications use the unserialize...

Mandrake Linux Security Advisory : zlib-pkgs (MDKSA-2002:023-1)

Matthias Clasen found a security issue in zlib that, when provided with certain input, causes zlib to free an area of memory twice. This 'double free' bug can be used to crash any programs that take untrusted compressed input, such as web browsers, email clients, image viewing software, etc. This...

RHEL 2.1 : cvs (RHSA-2003:013)

Updated CVS packages are now available for Red Hat Linux Advanced Server. These updates fix a vulnerability which would permit arbitrary command execution on servers configured to allow anonymous read-only access. Updated 06 Feb 2003 Added fixed packages for Advanced Workstation 2.1 CVS is a...

CVS Malformed Directory Request Double-free Privilege Escalation

According to its version number, the CVS server running on the remote host has a double free bug, which could allow a malicious user to elevate their privileges. C Tenable Network Security, Inc. include"compat.inc"; References: From: Stefan Esser Subject: Advisory 01/2003: CVS remote vulnerabilit...

FreeBSD-SA-03:01.cvs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-03:01.cvs Security Advisory The FreeBSD Project Topic: remotely exploitable vulnerability in cvs server Category: contrib Module: contribcvs Announced: 2003-02-04...