CVE-2016-9299

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server...

CVE-2016-9299

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server...

CVE-2016-9299

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server...

Debian: Security Advisory (DSA-3764-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Windows Server 2008 R2 domain controller crashes when two threads use the same LDAP connection

Windows Server 2008 R2 domain controller crashes when two threads use the same LDAP connection Summary This update fixes an access violation on the LSASS.exe process. This issue occurs because the Lightweight Directory Access Protocol LDAP connection is disconnected and reset from another thread...

CVE-2016-2123

A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndrpulldnspname contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndrpulldnspname parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute ov...

CVE-2016-2123

A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndrpulldnspname contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndrpulldnspname parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute ov...

Samba NDR Parsing ndr_pull_dnsp_name Heap-based Buffer

Description The Samba routine ndrpulldnspname contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndrpulldnspname parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory...

Amazon Linux AMI : 389-ds-base (ALAS-2016-773)

CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack It was found that 389 Directory Server was vulnerable to a remote password disclosure via timing attack. A remote attacker could possibly use this flaw to retrieve directory server password after many tries. CVE-2016-541...

CVE-2016-4992

An information disclosure flaw was found in 389 Directory Server. A user with no access to objects in certain LDAP sub-tree could send LDAP ADD operations with a specific object name. The error message returned to the user was different based on whether the target object existed or not...

Medium: 389-ds-base

Issue Overview: CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack It was found that 389 Directory Server was vulnerable to a remote password disclosure via timing attack. A remote attacker could possibly use this flaw to retrieve directory server password after many...

Scientific Linux Security Update : krb5 on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: krb5 1.14.1. Security Fixes : - A NULL pointer dereference flaw was found in MIT Kerberos kadmind service. An authenticated attacker with permission to modify a principal entry could use this flaw to cause kadmind to dereferen...

LDAP Code Injection

org.apache.karaf.jaas.modules is vulnerable to LDAP code injection. This is caused because the username is not encoded...

Fedora 24 : roundcubemail (2016-60753c3dcd)

Version 1.2.3 - Searching in both contacts and groups when LDAP addressbook with groupfilters option is used - Fix vulnerability in handling of mail's 5th argument - Fix To: header encoding in mail sent with mail method 5475 - Fix flickering of header topline in min-mode 5426 - Fix bug where...

Fedora 23 : roundcubemail (2016-b4896f20b3)

Version 1.2.3 - Searching in both contacts and groups when LDAP addressbook with groupfilters option is used - Fix vulnerability in handling of mail's 5th argument - Fix To: header encoding in mail sent with mail method 5475 - Fix flickering of header topline in min-mode 5426 - Fix bug where...

Fedora 25 : roundcubemail (2016-d361d188d9)

Version 1.2.3 - Searching in both contacts and groups when LDAP addressbook with groupfilters option is used - Fix vulnerability in handling of mail's 5th argument - Fix To: header encoding in mail sent with mail method 5475 - Fix flickering of header topline in min-mode 5426 - Fix bug where...

CVE-2016-6501

JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning...

CVE-2016-6496

The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning...

CVE-2016-6496

The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning...

Design/Logic Flaw

The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning...