KLA10748 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, spoof user interface and execute arbitrary code. Below is a complete list of vulnerabilities 1. Multiple memory safety...

Cisco Unified Computing System Manager Remote Command Execution Vulnerability (cisco-sa-20160120-ucsm)

A vulnerability in a CGI script in the Cisco Unified Computing System UCS Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on the Cisco UCS Manager. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources,...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0186-1)

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive a security fix. Following security bug was fixed : - A reference leak in keyring handling with joinsessionkeyring could lead to local attackers gain root privileges. bsc962075, CVE-2016-0728. Note that Tenable Network Security has...

FortiOS Fortimanager_Access SSH account backdoor

Added: 01/25/2016 CVE: CVE-2016-1909 Background FortiOS is the operating system used by FortiGate network security appliances. Problem An undocumented account can be used to gain unauthorized access to the appliance. Resolution Upgrade to FortiOS 4.1.11, 4.2.16, 4.3.17, 5.0.8, 5.2.0, 5.4.0, or...

FortiOS Fortimanager_Access SSH account backdoor

Added: 01/25/2016 CVE: CVE-2016-1909 Background FortiOS is the operating system used by FortiGate network security appliances. Problem An undocumented account can be used to gain unauthorized access to the appliance. Resolution Upgrade to FortiOS 4.1.11, 4.2.16, 4.3.17, 5.0.8, 5.2.0, 5.4.0, or...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0205-1)

The SUSE Linux Enterprise 12 kernel was updated to receive a security fix. Following security bug was fixed : - A reference leak in keyring handling with joinsessionkeyring could lead to local attackers gain root privileges. bsc962075, CVE-2016-0728. Note that Tenable Network Security has extract...

Juniper Junos IGMPv3 Protocol Multicast DoS (JSA10714)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability due to a flaw in the IGMPv3 implementation. An unauthenticated, remote attacker can exploit this, via a specially crafted IGMPv3 packet, to affect service availability o...

SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2016:0178-1)

This update for libxml2 fixes the following security issue : - CVE-2015-8710: Parsing short unclosed HTML comment could cause uninitialized memory access, which allowed remote attackers to read contents from previous HTTP requests depending on the application bsc960674 Note that Tenable Network...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerability (USN-2870-2)

Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privilege...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0168-1)

The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes. Following security bugs were fixed : - CVE-2015-7550: A local user could have triggered a race between read and revoke in keyctl bnc958951. - CVE-2015-8539: A negatively instantiated user key could have been...

Ubuntu 15.10 : linux-raspi2 vulnerability (USN-2872-3)

Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privilege...

Ubuntu 15.10 : linux vulnerability (USN-2872-1)

Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privilege...

Debian DLA-393-1 : srtp security update

Prevent potential DoS attack due to lack of bounds checking on RTP header CSRC count and extension header length. Credit goes to Randell Jesup and the Firefox team for reporting this issue. As there is no aead mode available in the Squeeze version, only srtpunprotect needed to be patched NOTE:...

Debian DLA-390-1 : dbconfig-common security update

It was discovered that dbconfig-common could, depending on the local umask, make PostgreSQL database backups that were readable by other users than the database owner. The issue is fixed in version 1.8.46+squeeze.1. Access rights to existing database backups not only for PostgreSQL will be limite...

SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2016:0118-1)

This update for openssh fixes the following issues : - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature bsc961642 - CVE-2016-0778: A malicious or compromised server could could trigger a...

SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2016:0120-1)

This update for openssh fixes the following issues : - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature bsc961642 - CVE-2016-0778: A malicious or compromised server could could trigger a...

SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:0121-1)

MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements. The following CVEs have been fixed : - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870,...

Kaspersky Lab found that the Silverlight zero-day-vulnerability warning-the black bar safety net

Recently, Kaspersky Lab found in the Silverlight application in the presence of a dangerous zero-day vulnerabilities, millions of users pose a security risk. On Wednesday, in a blog post, the network security company Kaspersky said the vulnerability would allow an attacker to gain access to the...

[SECURITY] Fedora 23 Update: openssh-7.1p2-1.fc23

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

Mozilla Firefox Spoofing Vulnerability (Jan 2016) - Windows

Mozilla Firefox is prone to a spoofing vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...