FreeBSD : cacti -- multiple vulnerabilities (db3301be-e01c-11e5-b2bd-002590263bf5)

The Cacti Group, Inc. reports : Changelog - bug:0002652: CVE-2015-8604: SQL injection in graphsnew.php - bug:0002655: CVE-2015-8377: SQL injection vulnerability in the hostnewgraphssave function in graphsnew.php - bug:0002656: Authentication using web authentication as a user not in the cacti...

FreeBSD : phpmyadmin -- multiple XSS and a man-in-the-middle vulnerability (f682a506-df7c-11e5-81e4-6805ca0b3d42)

The phpMyAdmin development team reports : XSS vulnerability in SQL parser. Using a crafted SQL query, it is possible to trigger an XSS attack through the SQL query page. We consider this vulnerability to be non-critical. Multiple XSS vulnerabilities. By sending a specially crafted URL as part of...

FreeBSD : wireshark -- multiple vulnerabilities (42c2c422-df55-11e5-b2bd-002590263bf5)

Wireshark development team reports : The following vulnerabilities have been fixed : - wnpa-sec-2015-31 NBAP dissector crashes. Bug 11602, Bug 11835, Bug 11841 - wnpa-sec-2015-37 NLM dissector crash. - wnpa-sec-2015-39 BER dissector crash. - wnpa-sec-2015-40 Zlib decompression crash. Bug 11548 -...

FreeBSD : wireshark -- multiple vulnerabilities (45117749-df55-11e5-b2bd-002590263bf5)

Wireshark development team reports : The following vulnerabilities have been fixed : - wnpa-sec-2016-02 ASN.1 BER dissector crash. Bug 11828 CVE-2016-2522 - wnpa-sec-2016-03 DNP dissector infinite loop. Bug 11938 CVE-2016-2523 - wnpa-sec-2016-04 X.509AF dissector crash. Bug 12002 CVE-2016-2524 -...

FreeBSD : moodle -- multiple vulnerabilities (2d299950-ddb0-11e5-8fa8-14dae9d210b8)

Marina Glancy reports : - MSA-16-0001: Two enrolment-related web services don't check course visibility - MSA-16-0002: XSS Vulnerability in course management search %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

FreeBSD : tomcat -- multiple vulnerabilities (1f1124fe-de5c-11e5-8fa8-14dae9d210b8)

Mark Thomas reports : - CVE-2015-5345 Apache Tomcat Directory disclosure - CVE-2016-0706 Apache Tomcat Security Manager bypass - CVE-2016-0714 Apache Tomcat Security Manager Bypass %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD : giflib -- heap overflow (90c8385a-dc9f-11e5-8fa8-14dae9d210b8)

Hans Jerry Illikainen reports : A heap overflow may occur in the giffix utility included in giflib-5.1.1 when processing records of the type IMAGEDESCRECORDTYPE' due to the allocated size of LineBuffer' equaling the value of the logical screen width, GifFileIn-SWidth', while subsequently having...

FreeBSD : pitivi -- code execution (6540c8f0-dca3-11e5-8fa8-14dae9d210b8)

Luke Farone reports : Double-clicking a file in the user's media library with a specially crafted path or filename allows for arbitrary code execution with the permissions of the user running Pitivi. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

FreeBSD : xen-kernel -- VMX: guest user mode may crash guest with non-canonical RIP (81f9d6a4-ddaf-11e5-b2bd-002590263bf5)

The Xen Project reports : VMX refuses attempts to enter a guest with an instruction pointer which doesn't satisfy certain requirements. In particular, the instruction pointer needs to be canonical when entering a guest currently in 64-bit mode. This is the case even if the VM entry information...

FreeBSD : xen-kernel -- VMX: intercept issue with INVLPG on non-canonical address (80adc394-ddaf-11e5-b2bd-002590263bf5)

The Xen Project reports : While INVLPG does not cause a General Protection Fault when used on a non-canonical address, INVVPID in its 'individual address' variant, which is used to back the intercepted INVLPG in certain cases, fails in such cases. Failure of INVVPID results in a hypervisor bug...

FreeBSD : xerces-c3 -- Parser Crashes on Malformed Input (a7f2e9c6-de20-11e5-8458-6cc21735f730)

The Apache Software Foundation reports : The Xerces-C XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bug...

FreeBSD : tomcat -- multiple vulnerabilities (7bbc3016-de63-11e5-8fa8-14dae9d210b8)

Mark Thomas reports : - CVE-2015-5346 Apache Tomcat Session fixation - CVE-2015-5351 Apache Tomcat CSRF token leak - CVE-2016-0763 Apache Tomcat Security Manager Bypass %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

FreeBSD : xen-kernel -- PV superpage functionality missing sanity checks (7ed7c36f-ddaf-11e5-b2bd-002590263bf5)

The Xen Project reports : The PV superpage functionality lacks certain validity checks on data being passed to the hypervisor by guests. This is the case for the page identifier MFN passed to MMUEXTMARKSUPER and MMUEXTUNMARKSUPER sub-ops of the HYPERVISORmmuextop hypercall as well as for various...

FreeBSD : django -- regression in permissions model (6b1d8a39-ddb3-11e5-8fa8-14dae9d210b8)

Tim Graham reports : User with 'change' but not 'add' permission can create objects for ModelAdmin's with saveas=True %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018...

FreeBSD : drupal -- multiple vulnerabilities (59a0af97-dbd4-11e5-8fa8-14dae9d210b8)

Drupal Security Team reports : - File upload access bypass and denial of service File module - Drupal 7 and 8 - Moderately Critical - Brute force amplification attacks via XML-RPC XML-RPC server - Drupal 6 and 7 - Moderately Critical - Open redirect via path manipulation Base system - Drupal 6, 7...

FreeBSD : squid -- remote DoS in HTTP response processing (660ebbf5-daeb-11e5-b2bd-002590263bf5)

Squid security advisory 2016:2 reports : Due to incorrect bounds checking Squid is vulnerable to a denial of service attack when processing HTTP responses. These problems allow remote servers delivering certain unusual HTTP response syntax to trigger a denial of service for all clients accessing...

FreeBSD : jenkins -- multiple vulnerabilities (7e01df39-db7e-11e5-b937-00e0814cab4e)

Jenkins Security Advisory : DescriptionSECURITY-232 / CVE-2016-0788Remote code execution vulnerability in remoting module A vulnerability in the Jenkins remoting module allowed unauthenticated remote attackers to open a JRMP listener on the server hosting the Jenkins master process, which allowed...

FreeBSD : jasper -- multiple vulnerabilities (006e3b7c-d7d7-11e5-b85f-0018fe623f2b)

oCERT reports : The library is affected by a double-free vulnerability in function jasiccattrvaldestroy as well as a heap-based buffer overflow in function jp2decode. A specially crafted jp2 file can be used to trigger the vulnerabilities. oCERT reports : The library is affected by an off-by-one...

FreeBSD : libsrtp -- DoS via crafted RTP header vulnerability (6171eb07-d8a9-11e5-b2bd-002590263bf5)

libsrtp reports : Prevent potential DoS attack due to lack of bounds checking on RTP header CSRC count and extension header length. Credit goes to Randell Jesup and the Firefox team for reporting this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

FreeBSD : bsh -- remote code execution vulnerability (9e5bbffc-d8ac-11e5-b2bd-002590263bf5)

Stian Soiland-Reyes reports : This release fixes a remote code execution vulnerability that was identified in BeanShell by Alvaro Munoz and Christian Schneider. The BeanShell team would like to thank them for their help and contributions to this fix! An application that includes BeanShell on the...