SUSE SLED11 / SLES11 Security Update : krb5 (SUSE-SU-2015:1282-1)

krb5 was updated to fix three security issues. Remote authenticated users could cause denial of service. These security issues were fixed : - CVE-2014-5353: NULL pointer dereference when using a ticket policy name as password name bsc910457. - CVE-2014-5354: NULL pointer dereference when using...

Hawkeye-G 3.0.1.4912 - Cross-Site Request Forgery

Exploit Title: CSRF, Network Threat Appliance IDS / IPS Google Dork: intitle: CSRF Network Threat Appliance IDS / IPS Date: 2015-07-24 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage: www.hexiscyber.com Software Link: www.hexiscyber.com/products/hawkeye-g...

Ubuntu 14.10 : Linux kernel vulnerabilities (USN-2685-1)

A flaw was discovered in the kvm kernel virtual machine subsystem's kvmapichasevents function. A unprivileged local user could exploit this flaw to cause a denial of service system crash. CVE-2015-4692 A flaw was discovered in how the Linux kernel handles invalid UDP checksums. A remote attacker...

Ubuntu 12.04 LTS : linux vulnerabilities (USN-2678-1)

A flaw was discovered in the user space memory copying for the pipe iovecs in the Linux kernel. An unprivileged local user could exploit this flaw to cause a denial of service system crash or potentially escalate their privileges. CVE-2015-1805 Daniel Borkmann reported a kernel crash in the Linux...

Oracle iPlanet Web Proxy Server 4.0.x < 4.0.26 NSS Signature Handling Remote Code Injection

According to its self-reported version, the Oracle iPlanet Web Proxy Server formerly known as Sun Java System Web Proxy Server installed on the remote host is version 4.0.x prior to 4.0.26. It is, therefore, affected by a flaw in the definitelengthdecoder function in the Network Security Services...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2015:1269-1)

MozillaFirefox, mozilla-nspr, and mozilla-nss were updated to fix 17 security issues. For more details please check the changelogs. - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards bsc935979. - CVE-2015-2728: Type confusion in Indexed Database Manager bsc935979. -...

SUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2015:1264-1)

PostgreSQL was updated to the security and bugfix release 9.3.8 including 9.3.7. Security issues fixed : - CVE-2015-3165, bsc931972: Avoid possible crash when client disconnects just before the authentication timeout expires. - CVE-2015-3166, bsc931973: Consistently check for failure of the print...

SUSE SLED11 / SLES11 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2015:1268-2)

MozillaFirefox, mozilla-nspr, and mozilla-nss were updated to fix 17 security issues. For more details please check the changelogs. These security issues were fixed : - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards bsc935979. - CVE-2015-2728: Type confusion in...

USN-2673-1 thunderbird vulnerabilities

Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to skip the ServerKeyExchange message and remove the forward-secrecy property...

Debian DLA-275-1 : ruby1.9.1 security update

It was discovered that the uri package in the Ruby standard library uses regular expressions that may result in excessive backtracking. Ruby applications that parse untrusted URIs using this library were susceptible to denial of service attacks by passing crafted URIs. For the oldoldstable...

Fedora 22 : drupal7-views_bulk_operations-3.3-1.fc22 (2015-11318)

7.x-3.3 See SA-CONTRIB-2015-131 Changes since 7.x-3.2: - Fix security vulnerability, by AdamPS. - Remove an entitylabel workaround that core no longer needs. - Issue 2427381 by axel.rutz: Rules component lacks entity type - Issue 2418751 by anrikun: Archive action fails silently - Issue 2318273 b...

Fedora 22 : squashfs-tools-4.3-11.fc22 (2015-10750)

Security fix for CVE-2015-4645 / CVE-2015-4646 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

SUSE SLED11 Security Update : flash-player (SUSE-SU-2015:1258-1)

flash-player was updated to fix two security issues. These security issues were fixed : - CVE-2015-5123: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 AS3 implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of...

Debian DLA-276-1 : inspircd security update

Adam , upstream author of inspircd found the Debian patch that fixed CVE-2012-1836 was incomplete. Furthermore, it introduced an issue, since invalid dns packets caused an infinite loop. This upload corrects these problems. As of today, no CVEs has been assigned to these Debian-specific flaws. Fo...

SUSE SLED12 / SLES12 Security Update : augeas (SUSE-SU-2015:1249-1)

This update fixes an untrusted argument escaping problem CVE-2014-8119 : - new API - augescapename - which can be used to escape untrusted inputs before using them as part of path expressions - augmatch is changed to return properly escaped output Note that Tenable Network Security has extracted...

Debian DLA-273-1 : tidy security update

Fernando Muoz discovered a security issue on the HTML syntax checker and reformatter tidy. Tidy did not properly process specific character sequences, and a remote attacker could exploit this flaw to cause a DoS, or probably, execute arbitrary code. Two different CVEs were assigned to this issue...

Fedora 21 : pcre-8.35-12.fc21 (2015-11019)

This release fixes two heap buffer overflows when compiling certain regular expressions: CVE-2015-3210 and CVE-2015-5073. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

Debian DLA-277-1 : libidn security update

Thijs Alkemade discovered that the Jabber server may pass an invalid UTF-8 string to libidn, the GNU library for Internationalized Domain Names IDNs. In the case of the Jabber server, this results in information disclosure, and it is likely that some other applications using libidn have similar...

3S CODESYS Runtime Toolkit Null Pointer Dereference Vulnerability

OVERVIEW Nicholas Miles of Tenable Network Security has identified a NULL pointer dereference vulnerability in 3S-Smart Software Solutions GmbH’s CODESYS Runtime Toolkit. 3S has produced a new version to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCT...

Juniper Networks Junos SRX Series SRX Network Security Daemon Denial of Service Vulnerability

Juniper Networks SRX Series services gateways with Junos are Juniper Networks' SRX Series gateway devices running the Junos operating system.The SRX Network Security Daemon nsd is SRX Network Security Daemon nsd is one of the network security daemons. A security vulnerability exists in the SRX ns...