Low: dhcp

Issue Overview: A flaw was found in the way the dhcpd daemon handled the expiration time of IPv6 leases. If dhcpd's configuration was changed to reduce the default IPv6 lease time, lease renewal requests for previously assigned leases could cause dhcpd to crash. CVE-2012-3955 Affected Packages:...

Medium: bind

Issue Overview: A flaw was found in the DNS64 implementation in BIND when using Response Policy Zones RPZ. If a remote attacker sent a specially-crafted query to a named server that is using RPZ rewrite rules, named could exit unexpectedly with an assertion failure. Note that DNS64 support is not...

Medium: openssh

Issue Overview: Due to the way the pamsshagentauth PAM module was built, the glibc's error function was called rather than the intended error function in pamsshagentauth to report errors. As these two functions expect different arguments, it was possible for an attacker to cause an application...

Important: java-1.6.0-openjdk

Issue Overview: Multiple improper permission check issues were discovered in the AWT, CORBA, JMX, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. Multiple flaws were found in the way image parsers in the 2D an...

Immunity Canvas: ACROBAT_XFA

Name| acrobatxfa ---|--- CVE| CVE-2013-0640 Exploit Pack| CANVAS Description| Adobe Acrobat Reader XFA =10.X Notes| CVE Name: CVE-2013-0640 VENDOR: Adobe VersionsAffected: 10.X and below Repeatability: CVE Url: https://vulners.com/cve/CVE-2013-0640 CERT Advisory: None CVSS: 9.3...

Medium: kernel, nvidia

Issue Overview: The xenfailsafecallback function in Xen for the Linux kernel 2.6.23 and other versions, when running a 32-bit PVOPS guest, allows local users to cause a denial of service guest crash by triggering an iret fault, leading to use of an incorrect stack pointer and stack corruption...

Medium: mysql51

Issue Overview: This update fixes several vulnerabilities in the MySQL database server. Affected Packages: mysql51 Issue Correction: Run yum update mysql51 or yum update --advisory ALAS-2013-152 to update your system. New Packages: i686: mysql51-5.1.67-1.60.amzn1.i686 ...

Important: java-1.7.0-openjdk

Issue Overview: Two improper permission check issues were discovered in the reflection API in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. Affected Packages: java-1.7.0-openjdk Issue Correction: Run yum update java-1.7.0-openjdk or yu...

Immunity Canvas: JAVA_MBEANINSTANTIATOR_FINDCLASS

Name| javaMBeanInstantiatorfindClass ---|--- CVE| CVE-2013-0422 Exploit Pack| CANVAS Description| javaMBeanInstantiatorfindClass Notes| CVE Name: CVE-2013-0422 VENDOR: Sun Notes: Affected versions JDK and JRE 7 Update 10 and earlier Tested on: - Windows 7 with JDK/JRE 7 update 10 To run from...

TWiki 5.1.2 Command Execution

This security advisory alerts you of a potential security issue with TWiki installations: The %MAKETEXT% TWiki variable allows arbitrary shell command execution. The problem is caused by an underlying security issue in the Locale::Maketext CPAN module. Vulnerable Software Version Attack Vectors...

TWiki 5.1.2 Command Execution Vulnerability

TWiki versions 4.x and 5.1.0 through 5.1.2 suffers from a remote command execution vulnerability due to an underlying security issue in the Locale::Maketext CPAN module. This security advisory alerts you of a potential security issue with TWiki installations: The %MAKETEXT% TWiki variable allows...

Important: bind

Issue Overview: A flaw was found in the DNS64 implementation in BIND. If a remote attacker sent a specially-crafted query to a named server, named could exit unexpectedly with an assertion failure. Note that DNS64 support is not enabled by default. CVE-2012-5688 Affected Packages: bind Issue...

Important: libxml2

Issue Overview: A heap-based buffer underflow flaw was found in the way libxml2 decoded certain entities. A remote attacker could provide a specially-crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or, potentially, execute arbitrar...

Important: mysql55

Issue Overview: A stack-based buffer overflow flaw was found in the user permission checking code in MySQL. An authenticated database user could use this flaw to crash the mysqld daemon or, potentially, execute arbitrary code with the privileges of the user running the mysqld daemon. CVE-2012-561...

Medium: libproxy

Issue Overview: A buffer overflow flaw was found in the way libproxy handled the downloading of proxy auto-configuration PAC files. A malicious server hosting a PAC file or a man-in-the-middle attacker could use this flaw to cause an application using libproxy to crash or, possibly, execute...

Adobe Plugs Several Buffer Overflow Holes in Shockwave Player

Adobe announced today it has repaired a host of critical buffer overflow vulnerabilities and an array out of bounds vulnerability in Shockwave Player and urges users to update to the latest version of the software, version 11.6.8.638. The company said it is not aware of active exploits. Both the...

Important: bind

Issue Overview: A flaw was found in the way BIND handled certain combinations of resource records. A remote attacker could use this flaw to cause a recursive resolver, or an authoritative server in certain configurations, to lockup. CVE-2012-5166 Affected Packages: bind Issue Correction: Run yum...

Medium: ruby

Issue Overview: Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the nameerrmesgtostr API function, which marks the string as tainted, a different...

Medium: munin

Issue Overview: Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart plugin. Affected Packages: munin Issue Correction:...

Medium: freeradius

Issue Overview: A buffer overflow flaw was discovered in the way radiusd handled the expiration date field in X.509 client certificates. A remote attacker could possibly use this flaw to crash radiusd if it were configured to use the certificate or TLS tunnelled authentication methods such as...