openSUSE Security Update : krb5 (openSUSE-SU-2011:0111-1)

Multiple KDC DoS vulnerabilities if used with LDAP backends have been fixed in krb5. CVE-2011-0281 and CVE-2011-0282 have been assigned. Additionally a DoS vulnerability in kpropd has been fixed. CVE-2010-4022 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

openSUSE Security Update : horde3 / horde3-dimp / horde3-imp (openSUSE-2012-112)

Warning: Official end of life for horde 3 is April 2012! Changes in horde3 : - version 3.3.13 - Fixed a XSS vulnerability CVE-2012-0909. - Added support for resetting passwords in LDAP. - Fixed compatibility with Firefox 10. Changes in horde3-imp : - Fixed XSS vulnerabilities CVE-2012-0791. -...

openSUSE Security Update : tomcat6 (openSUSE-SU-2011:0988-1)

The following security issues were fixed in tomcat : - Fixed a tomcat user password information leak CVE-2011-2204 - Fixed atomcat information leak and DoS CVE-2011-2526 Also one bug was fixed : - fix bnc702289 - suse manager pam ldap authentication fails - source CATALINAHOME/bin/setenv.sh if...

openSUSE Security Update : krb5 (openSUSE-SU-2010:0709-1)

remote authenticated clients could crash the kdc CVE-2010-1322. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update krb5-3259. The text description of this plugin is C SUSE LLC...

openSUSE Security Update : wireshark (openSUSE-SU-2013:1481-1)

This wireshark update to 1.8.10 fixes several security and non security bugs. bnc839607 + vulnerabilities fixed : - The NBAP dissector could crash. wnpa-sec-2013-55 CVE-2013-5718 - The ASSA R3 dissector could go into an infinite loop. wnpa-sec-2013-56 CVE-2013-5719 - The RTPS dissector could...

openSUSE Security Update : openldap2 (openSUSE-SU-2011:0359-1)

Master/slave configurations with enabled 'ppolicyforwardupdates' option potentially allowed users to log in with an invalid password CVE-2011-1024. unauthenticated users could crash the ldap server CVE-2011-1081. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packag...

openSUSE Security Update : proftpd (openSUSE-2011-19)

Vulnerabilities were discovered for the proftpd packages in openSUSE version 12.1. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2011-19. The text description of this plugin is C SU...

openSUSE Security Update : openstack-keystone (openSUSE-SU-2013:1089-1)

This update of openstack-keystone fixes two security vulnerabilities. - Add CVE-2013-2104.patch: fix missing expiration check in Keystone PKI token validation CVE-2013-2104, bnc821201 - Add CVE-2013-2157.patch: fix authentication bypass when using LDAP backend CVE-2013-2157, bnc823783 %NASLMINLEV...

Fedora 20 : php-horde-Horde-Ldap-2.0.6-1.fc20 (2014-7080)

jan SECURITY: Stricter parameter check in bind to detect empty passwords. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

CVE-2014-3465

The gnutlsx509dnoidname function in lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x before 3.2.10 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted X.509 certificate, related to a missing LDAP description for an OID when printing the DN...

CVE-2014-3465

The gnutlsx509dnoidname function in lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x before 3.2.10 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted X.509 certificate, related to a missing LDAP description for an OID when printing the DN...

Null pointer dereference

The gnutlsx509dnoidname function in lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x before 3.2.10 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted X.509 certificate, related to a missing LDAP description for an OID when printing the DN...

CVE-2014-3465

The gnutlsx509dnoidname function in lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x before 3.2.10 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted X.509 certificate, related to a missing LDAP description for an OID when printing the DN...

CVE-2014-3465

The gnutlsx509dnoidname function in lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x before 3.2.10 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted X.509 certificate, related to a missing LDAP description for an OID when printing the DN...

[SECURITY] Fedora 19 Update: mingw-curl-7.37.0-1.fc19

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

[SECURITY] Fedora 20 Update: mingw-curl-7.37.0-1.fc20

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

CVE-2014-2051

ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to conduct an LDAP injection attack via unspecified vectors, as demonstrated using a "login query."...

CVE-2014-2051

ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to conduct an LDAP injection attack via unspecified vectors, as demonstrated using a "login query."...

Code injection

ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to conduct an LDAP injection attack via unspecified vectors, as demonstrated using a "login query."...

CVE-2014-2051

ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to conduct an LDAP injection attack via unspecified vectors, as demonstrated using a "login query."...