Debian DSA-2721-1 : nginx - buffer overflow

A buffer overflow has been identified in nginx, a small, powerful, scalable web/proxy server, when processing certain chunked transfer encoding requests if proxypass to untrusted upstream HTTP servers is used. An attacker may use this flaw to perform denial of service attacks, disclose worker...

Debian: Security Advisory (DSA-2721-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2013-2164

The mmcioctlcdromreaddata function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning CD-ROM drive...

DEBIAN-CVE-2013-2147

The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via 1 a crafted IDAGETPCIINFO command for a...

PT-2013-3563 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 3.9.4 Description: The issue concerns the fill event metadata function in fs/notify/fanotify/fanotify user.c, which fails to initialize a certain structure member. This allows local users to obtain sensitive...

UBUNTU-CVE-2013-2147

The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via 1 a crafted IDAGETPCIINFO command for a...

Updated nginx package fixes security vulnerability

A security problem related to CVE-2013-2028 was identified, affecting some previous nginx versions if proxypass to untrusted upstream HTTP servers is used. The problem may lead to a denial of service or a disclosure of a worker process memory on a specially crafted response from an upstream proxi...

UBUNTU-CVE-2013-2141

The dotkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a 1 tkill or 2 tgkill system call...

nginx ngx_http_proxy_module.c Memory Disclosure

The installed version of nginx is 1.1.x, greater than or equal to 1.1.4, or 1.2.x prior to 1.2.9. It is, therefore, affected by a memory disclosure vulnerability in 'ngxhttpproxymodule.c' when 'proxypass' to untrusted upstream servers is used. By sending a specially crafted request, an attacker m...

nginx ngx_http_proxy_module.c Multiple Vulnerabilities

The installed version of nginx is 1.1.4 through 1.2.8, 1.3.x, or 1.4.x prior to 1.4.1. It is, therefore, affected by multiple vulnerabilities: - A stack-based buffer overflow in 'ngxhttpparse.c' may allow a remote attacker to execute arbitrary code or trigger a denial of service condition via a...

Fedora 18 : nginx-1.2.9-1.fc18 (2013-8182)

Update to upstream release 1.2.9 which fixes : - CVE-2013-2070 'denial of service or memory disclosure when using proxypass' fix build on platforms without gperftools Update to upstream release 1.4.0, which includes support for proxying of WebSocket connections, OCSP stapling, SPDY module, gunzip...

Mozilla: Uninitialized functions in DOMSVGZoomEvent (MFSA 2013-47)

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain...

Mozilla: Uninitialized functions in DOMSVGZoomEvent (MFSA 2013-47)

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain...

ISC BIND 9 Zero-Length RDATA Section Denial of Service / Information Disclosure

Binary data 6806.prm...

nginx < 1.4.1 / 1.5.0 Multiple Vulnerabilities

Binary data 6795.prm...

CVE-2013-1928

The dovideosetspupalette function in fs/compatioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEOSETSPUPALETTE ioctl call on a /dev/dvb device...

kernel: kvm: out-of-bounds access in ioapic indirect register reads

The ioapicreadindirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPICREGSELECT and IOAPICREGWINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of...

DEBIAN-CVE-2013-3227

The caifseqpktrecvmsg function in net/caif/caifsocket.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call...

Design/Logic Flaw

The roserecvmsg function in net/rose/afrose.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call...

DEBIAN-CVE-2013-2635

The rtnlfillifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application...