Microsoft SMB Client Remote Code Execution Vulnerabilities (2511455)

This host is missing a critical security update according to Microsoft Bulletin MS11-019. OpenVAS Vulnerability Test $Id: secpodms11-019.nasl 8724 2018-02-08 15:02:56Z cfischer $ Microsoft SMB Client Remote Code Execution Vulnerabilities 2511455 Authors: Veerendra GG Copyright: Copyright c 2011...

Ubuntu: Security Advisory (USN-1106-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : nss vulnerabilities (USN-1106-1)

It was discovered that several invalid HTTPS certificates were issued and revoked. An attacker could exploit these to perform a man in the middle attack to view sensitive information or alter encrypted communications. These certificates were marked as explicitly not trusted to prevent their misus...

CVE-2011-1652

CVE-2011-1652 concerns Windows 7 default behavior: upon IPv6 Router Advertisement, the system prefers a new IPv6/DHCPv6 path over existing IPv4/DHCPv4 and provides no option to ignore an unexpected RA. This enables remote attackers on the local network to perform man-in-the-middle attacks on traf...

The Problem of Issuing Certs For Unqualified Names

The recent attack on Comodo and several of its associated registration authorities has spurred quite a bit of re-examination of the way that the Web’s certificate authority infrastructure works–or doesn’t. One interesting result of this work is that the folks at the Electronic Frontier Foundation...

Ubuntu Update for qt4-x11 vulnerabilities USN-1101-1

Ubuntu Update for Linux kernel vulnerabilities USN-1101-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN11011.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for qt4-x11 vulnerabilities USN-1101-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH,...

USN-1101-1: Qt vulnerabilities

It was discovered that several invalid HTTPS certificates were issued and revoked. An attacker could exploit these to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications. These were placed on the certificate blocklist to prevent their misuse...

Ubuntu: Security Advisory (USN-1091-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for Firefox and Xulrunner vulnerabilities USN-1091-1

Ubuntu Update for Linux kernel vulnerabilities USN-1091-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN10911.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for Firefox and Xulrunner vulnerabilities USN-1091-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH,...

CVE-2011-0189

CVE-2011-0189: In Mac OS X 10.6, Terminal before 10.6.7 defaults to using SSH version 1 in the New Remote Connection dialog, which could allow MITM attackers to spoof SSH servers via protocol vulnerabilities. Red Hat/EUVD/OpenVAS/Nessus entries corroborate the same issue. Remediation per publicly...

Command injection

The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a...

SuSE 11 Security Update : MozillaFirefox, MozillaFirefox-branding-upstream, etc (SAT Patch Number 2254)

Mozilla Firefox was updated to version 3.5.9 fixing lots of bugs and security issues. The following security issues were fixed : - Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed...

CVE-2011-1429

Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766...

CVE-2011-1094

kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate...

CVE-2011-0411

The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is...

CVE-2011-0138

WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in...

Memory corruption

WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in...

CVE-2011-0115

The DOM level 2 implementation in WebKit, as used in Apple iTunes before 10.2 on Windows and Apple Safari, does not properly handle DOM manipulations associated with event listeners during processing of range objects, which allows man-in-the-middle attackers to execute arbitrary code or cause a...

CVE-2011-0147

WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in...

CVE-2011-0155

WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in...