SUSE-SU-2015:0400-1 Security update for xorg-x11-server

xorg-x11-server was updated to fix one security issue. This security issue was fixed: - CVE-2015-0255: Check string lenghts in XkbSetGeometry request bnc915810...

Enter: Stored XSS in api key of operator wallet

Make an operation wallet 2. Open wallet settings 3. Press "New key" 4. In source code remove "maxlength=30" of key's name input tag - no length check on server-side 5. Fill name input with "asdf" PoC 6. Press "Generate Key" 7. After that when open wallet settings we got XSS. 8. In case we can...

Mozilla NSS library RSA siagnature forgery

Signature validation bypass due to invalid length check in ASN.1 record...

Oracle Linux 7 : gnutls (ELSA-2014-0684)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0684 advisory. 3.1.18-9 - fix session ID length check 1102027 - fixes null pointer dereference 1101727 Tenable has extracted the preceding description block directly...

gnutls security update

3.1.18-9 - fix session ID length check 1102027 - fixes null pointer dereference 1101727...

Oracle Linux 5 : gnutls (ELSA-2014-0594)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0594 advisory. 1.4.1-16 - added missing check for null pointer 1102355 1.4.1-15 - fix session ID length check and null pointer dereference 1102355 - fix minitasn1...

wireshark: NFS dissector crash (wnpa-sec-2014-01)

The nfsnamesnoopaddname function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service memory corruption and application crash via a crafte...

samba: Heap-based buffer overflow due to incorrect DCE-RPC fragment length field check

Heap-based buffer overflow in the dcerpcreadncacnpacketdone function in librpc/rpc/dcerpcutil.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet...

DEBIAN-CVE-2013-6075

The comparedn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows 1 remote attackers to cause a denial of service out-of-bounds read, NULL pointer dereference, and daemon crash or 2 remote authenticated users to impersonate arbitrary users and bypass access restrictions vi...

Null pointer dereference

The comparedn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows 1 remote attackers to cause a denial of service out-of-bounds read, NULL pointer dereference, and daemon crash or 2 remote authenticated users to impersonate arbitrary users and bypass access restrictions vi...

CVE-2013-6075

The comparedn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows 1 remote attackers to cause a denial of service out-of-bounds read, NULL pointer dereference, and daemon crash or 2 remote authenticated users to impersonate arbitrary users and bypass access restrictions vi...

Oracle Linux 6 : kernel (ELSA-2012-1426)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1426 advisory. - mm hugetlb: do not use vmahugecacheoffset for vmapriotreeforeach Frederic Weisbecker 843034 843035 CVE-2012-2133 - mm hugepages: fix use after free b...

Oracle Linux 5 : kernel (ELSA-2013-0594)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0594 advisory. - fs udf: Fortify loading of sparing table Nikola Pajkovsky 843140 843141 CVE-2012-3400 - fs udf: Improve table length check to avoid possible overflow Nikola...

RHEL 6 : quagga (RHSA-2012:1259)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1259 advisory. - Quagga ospf6d: Stack-based buffer overflow while decoding Link State Update packet with malformed Inter Area Prefix LSA CVE-2011-3323 -...

(ospfd): Crash by processing LS-Update OSPF packet due improper length check of the Network-LSA structures

Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service daemon crash via a Link State Update aka LS Update packet containing a network-LSA link-state advertisement for which the data-structure length is smaller than the...

DEBIAN-CVE-2012-2136

The sockallocsendpskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a certain length value, which allows local users to cause a denial of service heap-based buffer overflow and system crash or possibly gain privileges by leveraging access to a TUN/TAP...

libtasn1 security update

2.3-3.1 - fix CVE-2012-1569 - missing length check when decoding DER lengths 804920...

FlashFXP v4.1.8.1701缓冲区溢出漏洞

FlashFXP是一款流行的FTP客户端 FlashFXP v4.1.8.1701在TListBox控件中使用固定长度缓冲区时缺少长度检查，在实现上存在缓冲区溢出漏洞，可导致控制进程、执行任意代码、系统控制 0 FlashFXP 4.1.8.1701 厂商补丁： FlashFXP -------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.flashfxp.com/...

Microsoft Word RTF文件解析栈溢出漏洞(MS10-087)

BUGTRAQ ID: 44652 CVE ID: CVE-2010-3333 Word是微软Office套件中的文字处理工具。 在处理RTF文档中的特定控制字时Word未经执行长度检查便将其属性字符串拷贝到了栈缓冲区中，这可能触发栈溢出。成功利用此漏洞的攻击者可以完全控制受影响的系统。 Microsoft Office XP SP3 Microsoft Office for Mac 2011 Microsoft Office 2010 Microsoft Office 2008 for Mac Microsoft Office 2007 SP2 Microsoft Office 200...

NSS: insecure Diffie-Hellman key exchange

The SSL implementation in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 does not properly set the minimum key length for Diffie-Hellman Ephemeral DHE mode, which makes it easier for remote attackers to defeat...