FreeBSD : piwik -- XSS vulnerability (22775cdd-395a-11e6-b3c8-14dae9d210b8)

Piwik reports : The Piwik Security team is grateful for the responsible disclosures by our security researchers: Egidio Romano granted a critical security bounty, James Kettle and Pawel Bartunek XSS and Emanuel Bronshtein limited XSS. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

FreeBSD : wget -- HTTP to FTP redirection file name confusion vulnerability (6df56c60-3738-11e6-a671-60a44ce6887b)

Giuseppe Scrivano reports : On a server redirect from HTTP to a FTP resource, wget would trust the HTTP server and uses the name in the redirected URL as the destination filename. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD : libxslt -- Denial of Service (1a2aa04f-3718-11e6-b3c8-14dae9d210b8)

Google reports : - 583156 Medium CVE-2016-1683: Out-of-bounds access in libxslt. Credit to Nicolas Gregoire. - 583171 Medium CVE-2016-1684: Integer overflow in libxslt. Credit to Nicolas Gregoire. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

FreeBSD : flash -- multiple vulnerabilities (07888b49-35c4-11e6-8e82-002590263bf5)

Adobe reports : These updates harden a mitigation against JIT spraying attacks that could be used to bypass memory layout randomization mitigations CVE-2016-1006. These updates resolve type confusion vulnerabilities that could lead to code execution CVE-2016-1015, CVE-2016-1019. These updates...

FreeBSD : Python -- Integer overflow in zipimport module (1d0f6852-33d8-11e6-a671-60a44ce6887b)

Python reports : Possible integer overflow and heap corruption in zipimporter.getdata %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors...

FreeBSD : flash -- multiple vulnerabilities (0e3dfdde-35c4-11e6-8e82-002590263bf5)

Adobe reports : These updates resolve type confusion vulnerabilities that could lead to code execution CVE-2016-4144, CVE-2016-4149. These updates resolve use-after-free vulnerabilities that could lead to code execution CVE-2016-4142, CVE-2016-4143, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147,...

FreeBSD : flash -- multiple vulnerabilities (0c6b008d-35c4-11e6-8e82-002590263bf5)

Adobe reports : These updates resolve type confusion vulnerabilities that could lead to code execution CVE-2016-1105, CVE-2016-4117. These updates resolve use-after-free vulnerabilities that could lead to code execution CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109,...

FreeBSD : chromium -- multiple vulnerabilities (d59ebed4-34be-11e6-be25-3065ec8fd3ec)

Google Chrome Releases reports : 3 security fixes in this release, including : - 620742 CVE-2016-1704: Various fixes from internal audits, fuzzing and other initiatives. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

FreeBSD : drupal -- multiple vulnerabilities (7932548e-3427-11e6-8e82-002590263bf5)

Drupal Security Team reports : - Saving user accounts can sometimes grant the user all roles User module - Drupal 7 - Moderately Critical - Views can allow unauthorized users to see Statistics information Views module - Drupal 8 - Less Critical %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

pfSense 2.3.1-RELEASE-p1 Squid 0.4.16_2 XSS / Log Manipulation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I. VULNERABILITY - ------------------------- Multiple vulnerabilities in squid 0.4.162 running on pfSense Version 2.3.1-RELEASE-p1 II. BACKGROUND - ------------------------- The pfSense project is a free network firewall distribution, based on the...

FreeBSD : botan -- cryptographic vulnerability (f771880c-31cf-11e6-8e82-002590263bf5)

MITRE reports : The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

FreeBSD : VLC -- Possibly remote code execution via crafted file (6d402857-2fba-11e6-9f31-5404a68ad561)

The VLC project reports : Fix out-of-bound write in adpcm QT IMA codec CVE-2016-5108 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors...

FreeBSD : botan -- multiple vulnerabilities (ac0900df-31d0-11e6-8e82-002590263bf5)

Jack Lloyd reports : Botan 1.10.13 has been released backporting some side channel protections for ECDSA signatures CVE-2016-2849 and PKCS 1 RSA decryption CVE-2015-7827. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fro...

FreeBSD : roundcube -- XSS vulnerability (97e86d10-2ea7-11e6-ae88-002590263bf5)

Roundcube reports : Fix XSS issue in href attribute on area tag 5240. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution an...

SOL00246015 - FreeBSD vulnerability CVE-2016-1886

Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...

SOL47009044 - FreeBSD vulnerability CVE-2016-1887

Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...

FreeBSD : OpenSSL -- vulnerability in DSA signing (6f0529e2-2e82-11e6-b2ec-b499baebfeaf)

The OpenSSL team reports : Operations in the DSA signing algorithm should run in constant time in order to avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that a non-constant time codepath is followed for certain operations. This has been demonstrated through a...

Microsoft creates its own FreeBSD VM Image for Azure Cloud Computing Platform

This year, Microsoft impressed the world with 'Microsoft loves Linux' announcements, like developing a custom Linux-based OS for running Azure Cloud Switch, selecting Ubuntu as the operating system for its Cloud-based Big Data services and bringing the popular Bash shell to Windows 10. Now, the...

The vulnerability of the FreeBSD operating system allows a hacker to trigger a service failure or increase their privileges.

The vulnerability of the sockargs function sys/kern/uipcsyscalls.c in the FreeBSD operating system is caused by a buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker acting locally to cause a service failure memory reallocation and kernel errors, or to increase...

FreeBSD : iperf3 -- buffer overflow (d6bbf2d8-2cfc-11e6-800b-080027468580)

ESnet reports : A malicious process can connect to an iperf3 server and, by sending a malformed message on the control channel, corrupt the server process's heap area. This can lead to a crash and a denial of service, or theoretically a remote code execution as the user running the iperf3 server....