FreeBSD : OpenSSL -- multiple vulnerabilities (d455708a-e3d3-11e6-9940-b499baebfeaf)

The OpenSSL project reports : - Truncated packet could crash via OOB read CVE-2017-3731 - Bad ECDHE parameters cause a client crash CVE-2017-3730 - BNmodexp may produce incorrect results on x8664 CVE-2017-3732 - Montgomery multiplication may produce incorrect results CVE-2016-7055 %NASLMINLEVEL...

FreeBSD : chromium -- multiple vulnerabilities (4b9ca994-e3d9-11e6-813d-e8e0b747a45a)

Google Chrome Releases reports : 51 security fixes in this release Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques...

FreeBSD : phpMyAdmin -- Multiple vulnerabilities (7721562b-e20a-11e6-b2e2-6805ca0b3d42)

The phpMyAdmin development team reports : Open redirect php-gettext code execution DOS vulnerability in table editing CSS injection in themes Cookie attribute injection attack SSRF in replication DOS in replication status %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

FreeBSD : mozilla -- multiple vulnerabilities (e60169c4-aa86-46b0-8ae2-0d81f683df09)

Mozilla Foundation reports : Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution a...

FreeBSD : Intel(R) NVMUpdate -- Intel(R) Ethernet Controller X710/XL710 NVM Security Vulnerability (a4b7def1-e165-11e6-9d84-90e2ba9881c8)

Intel Corporation reports : A security vulnerability in the IntelR Ethernet Controller X710 and IntelR Ethernet Controller XL710 family of products Fortville has been found in the Non-Volatile Flash Memory NVM image. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

FreeBSD : PHP -- undisclosed vulnerabilities (709e025a-de8b-11e6-a9a5-b499baebfeaf)

The PHP project reports : The PHP development team announces the immediate availability of PHP 7.0.15. This is a security release. Several security bugs were fixed in this release. The PHP development team announces the immediate availability of PHP 5.6.30. This is a security release. Several...

FreeBSD : mysql -- multiple vulnerabilities (4d2f9d09-ddb7-11e6-a9a5-b499baebfeaf)

Oracle reports : No further details have been provided in the Critical Patch Update %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors...

FreeBSD : powerdns -- multiple vulnerabilities (e3200958-dd6c-11e6-ae1b-002590263bf5)

PowerDNS reports : 2016-02: Crafted queries can cause abnormal CPU usage 2016-03: Denial of service via the web server 2016-04: Insufficient validation of TSIG signatures 2016-05: Crafted zone record can cause a denial of service %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

FreeBSD : icoutils -- check_offset overflow on 64-bit systems (57facd35-ddf6-11e6-915d-001b3856973b)

Choongwoo Han reports : An exploitable crash exists in the wrestool utility on 64-bit systems where the result of subtracting two pointers exceeds the size of int. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

FreeBSD : groovy -- remote execution of untrusted code/DoS vulnerability (4af92a40-db33-11e6-ae1b-002590263bf5)

The Apache Groovy project reports : When an application with Groovy on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when...

FreeBSD : MySQL -- multiple vulnerabilities (22373c43-d728-11e6-a9a5-b499baebfeaf)

The MySQL project reports : - CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer' sub component. - CVE-2016-5616, CVE-2016-6663: Race condition allows local users with certain permissions to gain privileges by leveraging use of mycopystat by REPAIR TABLE to repair a MyISAM table. ...

FreeBSD : wordpress -- multiple vulnerabilities (b180d1fb-dac6-11e6-ae1b-002590263bf5)

Aaron D. Campbell reports : WordPress versions 4.7 and earlier are affected by eight security issues... %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine...

FreeBSD : RabbitMQ -- Authentication vulnerability (6aa956fb-d97f-11e6-a071-001e67f15f5a)

Pivotal.io reports : MQTT MQ Telemetry Transport connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected. %NASLMINLEVE...

FreeBSD : mysql -- multiple vulnerabilities (e5186c65-d729-11e6-a9a5-b499baebfeaf)

Oracle reports : Local security vulnerability in 'Server: Packaging' sub component. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors...

UNIX security auditing tool: lunar

UNIX security auditing tool Lockdown UNix Auditing and Reporting This scripts generates a scored audit report of a Unix host’s security. It is based on the CIS and other frameworks. Why a shell script? I wanted a tool that was able to run on locked down systems where other tools may not be...

FreeBSD : Ansible -- Command execution on Ansible controller from host (a93c3287-d8fd-11e6-be5c-001fbc0f280f)

Computest reports : Computest found and exploited several issues that allow a compromised host to execute commands on the Ansible controller and thus gain access to other hosts controlled by that controller. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

FreeBSD : phpmailer -- Remote Code Execution (7ae0be99-d8bb-11e6-9b7f-d43d7e971a1b)

SecurityFocus reports : PHPMailer is prone to an local information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

FreeBSD : BIND -- multiple vulnerabilities (d4c7e9a9-d893-11e6-9b4d-d050996490d0)

ISC reports : A malformed query response received by a recursive server in response to a query of RTYPE ANY could trigger an assertion failure while named is attempting to add the RRs in the query response to the cache. Depending on the type of query and the EDNS options in the query they receive...

Donald Trump appoints a CyberSecurity Advisor Whose Own Site is Damn Vulnerable

Former New York City Mayor Rudolph W. Giuliani has been appointed as a cyber security advisor for the President-elect Donald Trump, but it appears that he never actually checked the security defenses of his own company's website. Giuliani is going to head a new Cybersecurity Working group for the...

FreeBSD : FreeBSD -- OpenSSH multiple vulnerabilities (2c948527-d823-11e6-9171-14dae9d210b8)

The ssh-agent1 agent supports loading a PKCS11 module from outside a trusted whitelist. An attacker can request loading of a PKCS11 module across forwarded agent-socket. CVE-2016-10009 When privilege separation is disabled, forwarded Unix domain sockets would be created by sshd8 with the privileg...