BusyBox DNS Configuration

This module will be applied on a session connected to a BusyBox shell. It allows to set the DNS server on the device executing BusyBox so it will be sent by the DHCP server to network hosts. This module requires Metasploit: https://metasploit.com/download Current source:...

Fedora 22 : php-ZendFramework2-2.4.7-1.fc22 / php-guzzle-Guzzle-3.9.3-5.fc22 (2015-13529)

Zend Framework Upstream ChangeLogs: Version 2.4.7 Version 2.4.6 Version 2.4.5 Version 2.4.4 Version 2.4.3 Version 2.4.2 Version 2.4.1 Version 2.4.0 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

[SECURITY] Fedora 21 Update: openssh-6.6.1p1-16.fc21

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

Debian DLA-301-1 : python-django security update

denial of service possibility in logout view by filling session store Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view provided it wasn't decorated with django.contrib.auth.decorators.loginrequired as done in the admin. This could allow a...

SUSE SLED12 / SLES12 Security Update : p7zip (SUSE-SU-2015:1433-1)

This update fixes the following security issue : - CVE-2015-1038: directory traversal vulnerability bnc912878 This could for the overwriting of arbitrary files through uncompressing a crafted archive, with the privileges of the user running 7z Note that Tenable Network Security has extracted the...

NSS: ECDSA signature validation fails to handle some signatures correctly (MFSA 2015-64)

A flaw was found in the way NSS verified certain ECDSA Elliptic Curve Digital Signature Algorithm signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery attacks...

NSS: incorrectly permited skipping of ServerKeyExchange (MFSA 2015-71)

It was found that NSS permitted skipping of the ServerKeyExchange packet during a handshake involving ECDHE Elliptic Curve Diffie-Hellman key Exchange. A remote attacker could use this flaw to bypass the forward-secrecy of a TLS/SSL connection...

SUSE SLED11 / SLES11 Security Update : tiff (SUSE-SU-2015:1420-1)

tiff was updated to fix six security issues found by fuzzing initiatives. These security issues were fixed : - CVE-2014-8127: Out-of-bounds write bnc914890. - CVE-2014-8128: Out-of-bounds write bnc914890. - CVE-2014-8129: Out-of-bounds write bnc914890. - CVE-2014-8130: Out-of-bounds write...

Facebook ThreatExchange Information Sharing

As Facebook’s ThreatExchange information-sharing platform hits its six-month milestone, the social network today announced that its closing in on 100 participants and has streamlined the application process. ThreatExchange was launched in February as a free vehicle for sharing threat and attack...

Fedora 21 : xfsprogs-3.2.2-2.fc21 (2015-12406)

Gabriel Vlasiu reported that xfsmetadump, part of the xfsprogs suite of tools for the XFS filesystem, did not properly obfuscate data. xfsmetadump properly obfuscates active metadata, but the rest of the space within that fs block comes through in the clear. This could lead to exposure of stale...

Fedora 21 : rubygems-2.2.5-100.fc21 (2015-13157)

Update to RubyGems 2.2.5. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenabl...

[SECURITY] Fedora 22 Update: openssh-6.9p1-5.fc22

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

Easy File Management Web Server 5.6 Buffer Overflow

!/usr/bin/python Exploit Title: Easy File Management Web Server v5.6 - USERID Remote Buffer Overflow Version: 5.6 Date: 2015-08-17 Author: Tracy Turben [email protected] Software Link: http://www.efssoft.com/ Tested on: Win7x32-EN Special Thanks To: Julien Ahrens for the crafted jmp esp Trick...

Fedora 23 : nagios-plugins-2.0.3-1.fc23 (2015-12853)

Update to 2.0.3 release to fix various CVE issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 21 : erlang-17.4-4.fc21 (2015-12970)

Security fix for CVE-2015-2774 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Fedora 22 : golang-1.4.2-3.fc22 (2015-13002)

security fixes for net/http smuggling Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

[SECURITY] [DSA 3336-1] nss security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3336-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 17, 2015 https://www.debian.org/security/faq -...

Fedora 22 : bzr-2.6.0-8.fc22 (2015-12001)

Security fix for CVE-2013-7440 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Debian DLA-293-1 : subversion security update

C. Michael Pilato, from CollabNet, reported an issue in the version control system Subversion. CVE-2015-3187 Subversion servers revealed some sensible paths hidden by path-based authorization. Remote authenticated users were allowed to obtain path information by reading the history of a node that...

CVE-2015-3750

CVE-2015-3750 concerns WebKit in WebKit-based components (e.g., Apple Safari, WebKit2) where Content Security Policy report requests did not have enforceable HTTP Strict Transport Security (HSTS). The failing behavior allowed a MITM to sniff sensitive data or spoof CSP report data, including cook...