Freeciv: User-assisted execution of arbitrary code

Background Freeciv is an open-source empire building strategy game. Description The Lua component of Freeciv does not restrict which modules may be loaded by scenario scripts. Impact A remote attacker could entice a user to open a specially crafted scenario file, possibly resulting in execution o...

Banshee: Arbitrary code execution

Background Banshee is a multimedia management and playback application for GNOME. Description Banshee places a zero-length directory name in PATH, which allows libraries to be loaded from the working directory. Impact A local attacker could put specially crafted library into working directory of...

GNUstep Base library: Multiple vulnerabilities

Background GNUstep Base library is a free software package implementing the API of the OpenStep Foundation Kit tm, including later additions. Description Multiple vulnerabilities have been discovered in GNUstep Base library. Please review the CVE identifiers referenced below for details. Impact A...

GLSA-201312-14 : libsndfile: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201312-14 libsndfile: Arbitrary code execution An integer overflow flaw has been discovered in Libsndfile. Impact : A remote attacker could entice a user to open a specially crafted PAF file using libsndfile, possibly resulting in...

libsmi: Arbitrary code execution

Background libsmi is a library that allows management applications to access SMI MIB module definitions. Description libsmi contains a buffer overflow vulnerability in the smiGetNode function in lib/smi.c. Impact A context-dependent attacker could possibly execute arbitrary code by way of a...

cabextract: Multiple vulnerabilities

Background cabextract is free software for extracting Microsoft cabinet files. Description Multiple vulnerabilities have been discovered in cabextract. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a specially-crafted archive ...

OpenJDK: getDeclaringClass() information leak (Libraries, 8014349)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries...

OpenJDK: java.util.TimeZone does not restrict setting of default time zone (Libraries, 8001029)

Unspecified vulnerability in the Java SE, Java SE Embedded component in Oracle Java SE Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related ...

OpenJDK: InputStream skip() information leak (Networking/IO, 7000600)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.233 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown...

OpenJDK: ObjectStreamClass circular reference denial of service (Serialization, 8000638)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect availability via unknown vectors related to Serialization. NOTE: the previous...

OpenJDK: output stream access restrictions (CORBA, 8000642)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via vectors related to CORBA. NOTE: the previous information ...

JDK: unspecified vulnerability fixed in 7u45 (2D)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to 2D...

CVE-2007-6755

The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation DualECDRBG algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection...

Error "One or more legacy replicas are detected in configuration remove them manually and try again" during upgrade to v7

Challenge During version 7.x Upgrade from 6.x, you receive the error "One or more legacy replicas are detected in configuration remove them manually and try again". Legacy Replicas are any replica created by Veeam Backup prior to version 6.x. Cause Legacy Created prior to Version 6 of Veeam Backu...

sos security update

1.7-9.62.0.1.el59.1 - add patch to remove all sysrq echo commands from sysreport.legacy John Sobecki orabug 11061754 - comment out rh-upload-core and README.rh-upload-core in specfile 1.7-9.62.el59.1 - Remove anaconda-ks.cfg collection from general plug-in Resolves: bz965807 1.7-9.62.el59 - Elide...

Remembering Barnaby Jack

It’s said that each man’s death diminishes us all in some way. But some passings take a bigger piece than others. The death of Barnaby Jack is one of those, having left a major hole in the security community and let a lot of air out of the room. Jack, who died suddenly on July 25 of as-yet unknow...

JDK: unspecified vulnerability fixed in 7u25 (Deployment)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Deployment...

Fedora 18 : telepathy-gabble-0.16.6-1.fc18 (2013-9794)

"This release fixes a man-in-the-middle attack. If you use an unencrypted connection to a 'legacy Jabber' pre-XMPP server, this version of Gabble will not connect until you make one of these configuration changes : - upgrade the server software to something that supports XMPP 1.0; or - use an...

Fedora 19 : telepathy-gabble-0.17.4-1.fc19 (2013-9753)

"This release fixes a man-in-the-middle attack. If you use an unencrypted connection to a 'legacy Jabber' pre-XMPP server, this version of Gabble will not connect until you make one of these configuration changes : - upgrade the server software to something that supports XMPP 1.0; or - use an...

Important: Red Hat Security Advisory: Red Hat JBoss BRMS 5.3.1 update

Red Hat JBoss BRMS 5.3.1 roll up patch 2, which fixes multiple security issues and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores,...