Fedora 23 : freeipa (2016-7898627d08)

security fix for CVE-2016-5404 related: https://bugzilla.redhat.com/showbug.cgi?id=1367883 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possibl...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:1709-1)

The SUSE Linux Enterprise 12 kernel was updated to receive critical security and bugfixes. Security issue fixed : - CVE-2016-4997: A buffer overflow in 32bit compatsetsockopt iptables handling could lead to a local privilege escalation. bsc986362 The update package also includes non-security fixe...

SUSE SLED12 / SLES12 Security Update : php5 (SUSE-SU-2016:1633-1)

This update for php5 fixes the following issues : - CVE-2013-7456: imagescale out-of-bounds read bnc982009. - CVE-2016-5093: geticuvalueinternal out-of-bounds read bnc982010. - CVE-2016-5094: Don't create strings with lengths outside of valid range bnc982011. - CVE-2016-5095: Don't create strings...

Juniper Junos Denial of Service Vulnerability (CNVD-2016-06867)

Juniper Junos is a Juniper Networks network operating system designed for the company's hardware systems. The operating system provides a secure programming interface and the Junos SDK. Juniper Junos has a denial of service vulnerability that could be exploited by an attacker to cause a denial of...

SUSE SLED12 / SLES12 Security Update : dhcp (SUSE-SU-2016:1692-1)

This update for dhcp fixes the following issues : - CVE-2016-2774: Fixed a denial of service attack against the DHCP server over the OMAPI TCP socket, which could be used by network adjacent attackers to make the DHCP server non-functional bsc969820. Note that Tenable Network Security has extract...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss (SUSE-SU-2016:1691-1)

MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nss and mozilla-nspr were updated to fix nine security issues. Mozilla Firefox was updated to version 45.2.0 ESR. mozilla-nss was updated to version 3.21.1. These security issues were fixed : - CVE-2016-2834: Memory safety bugs in NSS MFSA...

A simple four-step, teach you do-it-yourself porting Cisco ASA exploits EXTRABACON-vulnerability warning-the black bar safety net

! In the past few days,We carefully analysed by the Shadow Brokers leaked NSA exploit code EXTRABACON it. According to XORcat derived from the initial analysis,the exploit code can use the SNMP service memory corruption vulnerability to bypass the Cisco ASA device authentication. We in the lab fo...

SUSE SLES11 Security Update : dhcp (SUSE-SU-2016:1735-1)

This update for dhcp fixes the following issues : - CVE-2016-2774: Fixed a denial of service attack against the DHCP server over the OMAPI TCP socket, which could be used by network adjacent attackers to make the DHCP server non-functional bsc969820. Note that Tenable Network Security has extract...

SUSE SLED12 / SLES12 Security Update : libtasn1 (SUSE-SU-2016:1601-1)

This update for libtasn1 fixes the following issues : - Malformed asn1 definitions could have caused a segmentation fault in the asn1 definition parser bsc961491 - CVE-2015-3622: Fixed invalid read in octet string decoding bsc929414 - CVE-2016-4008: Fixed infinite loop while parsing DER...

NECROSOFT NScan 0.9.1 Buffer Overflow

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NECROSCAN-BUFFER-OVERFLOW.txt + ISR: ApparitionSec Vendor: =================== nscan.hypermart.net Product: ====================================== NECROSOFT NScan version =...

Mailbox fishing those things: the Chrome address reverse vulnerability use cases-vulnerability warning-the black bar safety net

First talk about the recently seen one of the more interesting vulnerability, the Google browser chrome address inversion, later we'll said. One day, your mailbox has received an incredible message that may come from your boss or your best friend, do not feel strange, it is likely that you are...

Fedora 24 : pagure (2016-40d5f1d3c2)

CVE-2016-1000037 ---- Update to 2.3.3 Be sure to read UPGRADING.rst Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Debian DLA-599-1 : cracklib2 security update

It was discovered that there was a stack-based buffer overflow when parsing large GECOS fields in cracklib2, a pro-active password checker library. For Debian 7 'Wheezy', this issue has been fixed in cracklib2 version 2.8.19-3+deb7u1. We recommend that you upgrade your cracklib2 packages. NOTE:...

Fedora 24 : firewalld (2016-de55d2c2c9)

Fix CVE-2016-5410: Firewall configuration can be modified by any logged in user - firewall/server/firewalld: Make getXSettings and getLogDenied CONFIGINFO - Update AppData configuration file. - tests/firewalldrich.py: Use new import structure and FirewallClient classes - tests/firewallddirect.py:...

NSA USA NSA）leakage of the document depth analysis PART 1-the vulnerability warning-the black bar safety net

One, Foreword The firewall is protect the network the machine is not affected by the network attacker against the first track is also very core of the Defense, the most basic function is that external parties cannot access to the internal network of the machine, the internal staff can normally...

Unsecured DNSSEC Easily Weaponized, Researchers Warn

DNSSEC is not invincible. Researchers this week described how a DNSSEC-based flood attack could easily knock a website offline and allow for the insertion of malware or exfiltration of sensitive data. The intent of Domain Name System Security Extensions, or DNSSEC, is to bolster DNS through a...

Fedora 23 : python3 (2016-604616dc33) (httpoxy)

Fix for CVE-2016-1000110 HTTPoxy attack Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 24 : chromium (2016-e9798eaaa3)

On 2016-08-04 Google released Chrome 52.0.2743.116 which fixes at least 8 security issues: CVE-2016-5141, CVE-2016-5142, CVE-2016-5139, CVE-2016-5140, CVE-2016-5145, CVE-2016-5143 and CVE-2016-5144. Additionally, this update : - Splits libmedia and libffmpeg into the libs-media subpackage, so tha...

Samsung Smart Home Camera SNH-P-6410 - Command Injection

Exploit for hardware platform in category remote exploits E-DB Note: source https://www.pentestpartners.com/blog/samsungs-smart-camera-a-tale-of-iot-network-security/ import urllib, urllib2, crypt, time New password for web interface webpassword = 'admin' New password for root rootpassword = 'roo...

Samsung Smart Home Camera SNH-P-6410 - Command Injection

Samsung Smart Home Camera SNH-P-6410 - Command Injection E-DB Note: source https://www.pentestpartners.com/blog/samsungs-smart-camera-a-tale-of-iot-network-security/ import urllib, urllib2, crypt, time New password for web interface webpassword = 'admin' New password for root rootpassword = 'root...