[SECURITY] Fedora 23 Update: kernel-4.8.13-100.fc23

The kernel meta package...

[SECURITY] Fedora 25 Update: kernel-4.8.13-300.fc25

The kernel meta package...

[SECURITY] Fedora 24 Update: kernel-4.8.12-200.fc24

The kernel meta package...

Cross-Site Scripting (XSS)

django-meta is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript due to the lack of escaping values before rendering...

Firefox - SVG cross domain cookie vulnerability （CVE-2016-9078）

Original link: http://insert-script.blogspot.jp/2016/12/firefox-svg-cross-domain-cookie.html Author: the Alex Inführ Translation: Holic know Chong Yu 404 Safety laboratory , this article has additions and changes Note: the vulnerability only affects Firefox 49 and 50 version, details see the...

[SECURITY] Fedora 24 Update: kernel-4.8.11-200.fc24

The kernel meta package...

BlueZ read-across-the-border vulnerability (CNVD-2016-11953)

BlueZ is an official Bluetooth stack for Linux. A security vulnerability exists in the 'lemetaevdump' function in the tools/parser/hci.c source file of BlueZ version 5.42. An attacker can exploit this vulnerability to read data across boundaries...

UBUNTU-CVE-2016-9803

In BlueZ 5.42, an out-of-bounds read was observed in "lemetaevdump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' which is used to read correct element from 'evlemetastr' array is overflowed...

[SECURITY] Fedora 24 Update: kernel-4.8.8-200.fc24

The kernel meta package...

[SECURITY] Fedora 24 Update: kernel-4.8.7-200.fc24

The kernel meta package...

VK.com: Stored XSS в личных сообщениях

Lack of data filtration, which leads to stored XSS in instant messenger service. Stored XSS in personal messages. The vulnerability exists due to the lack of filtering data which is taken from the META tags for demonstration preview of the site...

[SECURITY] Fedora 23 Update: perl-Image-Info-1.38-6.fc23

This Perl extension allows you to extract meta information from various types of image files...

[SECURITY] Fedora 24 Update: perl-Image-Info-1.38-6.fc24

This Perl extension allows you to extract meta information from various types of image files...

[SECURITY] Fedora 25 Update: kernel-4.8.3-300.fc25

The kernel meta package...

[SECURITY] Fedora 25 Update: perl-Image-Info-1.38-6.fc25

This Perl extension allows you to extract meta information from various types of image files...

HackerOne: Obtain the username & the uid of the one doing the S3 sync on Hackerone

Obtain the username & uid of hackerone.com S3 using GET, it's possible to obtain the username & uid of the one doing the S3 sync on Hackerone. Doing a GET on : http://hackerone.com Give the following header : content-security-policy = default-src 'none'; base-uri 'self'; block-all-mixed-content;...

[SECURITY] Fedora 25 Update: kernel-4.8.0-0.rc7.git0.1.fc25

The kernel meta package...

WP Front End Profile <= 0.2.1 - Privilege Escalation & Stored Cross-Site Scripting (XSS)

It is possible to modify a POST request to overwrite user meta including 'wpcapabilities' and 'wpuserlevel' which results in a privilege escalation vulnerability. User input is not sanitised or escaped on output resulting in a stored XSS vulnerability. Timeline: 2016-09-12: Vulnerability found...

Debian DSA-3652-1 : imagemagick - security update

This updates fixes many vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed TIFF, WPG, RLE, RAW, PSD, Sun, PICT, VIFF, HDR, Meta, Quantum, PDB, DDS, DCM...

Debian Security Advisory DSA 3652-1 (imagemagick - security update)

This updates fixes many vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed TIFF, WPG, RLE, RAW, PSD, Sun, PICT, VIFF, HDR, Meta, Quantum, PDB, DDS, DCM...