openSUSE Security Update : glibc (openSUSE-2015-173)

Glibc was updated to fix several security issues. - Avoid infinite loop in nssdns getnetbyname CVE-2014-9402, bsc910599, BZ 17630 - wordexp fails to honour WRDENOCMD CVE-2014-7817, bsc906371, BZ 17625 - Fix invalid file descriptor reuse while sending DNS query CVE-2013-7423, bsc915526, BZ 15946 -...

Ubuntu: Security Advisory (USN-2519-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : php5 -- multiple vulnerabilities (f7a9e415-bdca-11e4-970c-000c292ee6b8) (GHOST)

The PHP Project reports : Use after free vulnerability in unserialize with DateTimeZone. Mitigation for CVE-2015-0235 -- GHOST: glibc gethostbyname buffer overflow. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

Cisco Unified Communications Manager Remote Buffer Overflow (CSCus66650) (GHOST)

According to its self-reported version, the remote Cisco Unified Communications Manager CUCM device is affected by a heap-based buffer overflow in the GNU C Library glibc due to improperly validating user-supplied input in the glibc functions nsshostnamedigitsdots, gethostbyname, and...

Security Advisory - Glibc Buffer Overflow Vulnerability

Huawei noticed that Qualys had disclosed the buffer overflow in the GNU C Library glibc on January 27th, 2015, Applications call various gethostbyname function are affected and attackers can exploit this vulnerability to perform remote code execution. Vulnerability ID: HWPSIRT-2015-01045 This...

PHP 5.6.x < 5.6.6 Multiple Vulnerabilities (GHOST)

According to its banner, the version of PHP 5.6.x installed on the remote host is prior to 5.6.6. It is, therefore, affected by multiple vulnerabilities : - A heap-based buffer overflow flaw in the enchantbrokerrequestdict function in ext/enchant/enchant.c could allow a remote attacker to cause a...

PHP 5.5.x < 5.5.22 Multiple Vulnerabilities (GHOST)

According to its banner, the version of PHP 5.5.x installed on the remote host is prior to 5.5.22. It is, therefore, affected by multiple vulnerabilities : - A heap-based buffer overflow flaw in the enchantbrokerrequestdict function in ext/enchant/enchant.c could allow a remote attacker to cause ...

CVE-2014-9402

The nssdns implementation of getnetbyname in GNU C Library aka glibc before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service infinite loop by sending a positive answer while a network name is being process...

DEBIAN-CVE-2013-7423

The senddg function in resolv/ressend.c in GNU C Library aka glibc or libc6 before 2.20 does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function...

CVE-2014-9402

The nssdns implementation of getnetbyname in GNU C Library aka glibc before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service infinite loop by sending a positive answer while a network name is being process...

CVE-2013-7423

CVE-2013-7423: in glibc, the send_dg path can cause DNS queries to be written to unintended file descriptors under load, enabling local access to sensitive information. IBM advisories confirm affected products (e.g., DataPower Gateways, QRadar/NIPS contexts) and list concrete fixes: upgrade to fi...

CVE-2014-9402

CVE-2014-9402 affects the GNU C Library (glibc) nss_dns getnetbyname when the DNS backend in NSS is enabled. Before version 2.21, a remote attacker can trigger an infinite loop by sending a positive answer while a network name is being processed, causing DoS. Affected: glibc with DNS NSS backend ...

CVE-2014-9402

The nssdns implementation of getnetbyname in GNU C Library aka glibc before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service infinite loop by sending a positive answer while a network name is being process...

Fedora 21 : php-5.6.6-1.fc21 (2015-2315)

19 Feb 2015, PHP 5.6.6 Core : - Removed support for multi-line headers, as the are deprecated by RFC 7230. Stas - Fixed bug 67068 getClosure returns somethings that's not a closure. Danack at basereality dot com - Fixed bug 68942 Use after free vulnerability in unserialize with DateTimeZone...

Debian DSA-3169-1 : eglibc - security update

Several vulnerabilities have been fixed in eglibc, Debian's version of the GNU C library : - CVE-2012-3406 The vfprintf function in stdio-common/vfprintf.c in GNU C Library aka glibc 2.5, 2.12, and probably other versions does not 'properly restrict the use of' the alloca function when allocating...

CVE-2014-9402

The nssdns implementation of getnetbyname in GNU C Library aka glibc before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service infinite loop by sending a positive answer while a network name is being process...

[SECURITY] [DSA 3169-1] eglibc security update

---------------------------------------------------------------------- Debian Security Advisory DSA-3169-1 [email protected] http://www.debian.org/security/ Aurelien Jarno February 23, 2015 http://www.debian.org/security/faq -...

GNU glibc 'strxfrm()' function integer overflow vulnerability

GNU glibc is an implementation of the C library for the Linux operating system. An integer overflow vulnerability exists in the GNU glibc 'strxfrm' function, which could be exploited by remote attackers to crash an application or execute arbitrary code...

Cisco Application Control Engine GNU glibc gethostbyname Function Buffer Overflow Vulnerability (cisco-sa-20150128-ghost) (GHOST)

The Cisco Application Control Engine ACE software installed on the remote Cisco IOS device is version A23.6d or A53.1b. It is, therefore, affected by a heap-based buffer overflow vulnerability in the GNU C Library glibc due to improperly validating user-supplied input to the nsshostnamedigitsdots...

Cisco TelePresence Video Communication Server GNU glibc gethostbyname Function Buffer Overflow Vulnerability (GHOST)

According to its self-reported version number, the Cisco TelePresence Video Communication Server is affected by a heap-based buffer overflow vulnerability in the GNU C Library glibc due to improperly validating user-supplied input to the nsshostnamedigitsdots, gethostbyname, and gethostbyname2...