SUSE SLES12 Security Update : glibc (SUSE-SU-2017:1614-1) (Stack Clash)

This update for glibc fixes the following issues : - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. bsc1039357 - The incorrectly defined constant OTMPFILE has been...

Kernel Vulnerability

A vulnerability exists in the Linux kernel of PAN-OS that may result in Remote Code Execution. A vulnerability in the Linux kernel networking subsystem for UDP could enable an attacker to execute arbitrary code within the context of the kernel. The Data Plane DP of PAN-OS is not affected by this...

ARP Firewall: SCUTUM

SCUTUM is an ARP firewall that prevents your computer from being arp spoofed. Scutum controls “arptables” in your computer so it accepts ARP packets only from the gateway. This way, people with malicious intentions cannot spoof your arp table. Scutum also prevents other people from detecting your...

Debian DLA-989-1 : jython security update

Alvaro Munoz and Christian Schneider discovered that Jython, an implementation of the Python language seamlessly integrated with Java, would execute arbitrary code when deserializing objects. For Debian 7 'Wheezy', these problems have been fixed in version 2.5.2-1+deb7u1. We recommend that you...

Fedora 25 : 3:mariadb (2017-2c0609b92a)

Rebase to 10.1.24 Plugin oqgraph enabled Plugin jemalloc enabled Sphinx engine enabled Build dependecies Bison and Libarchive added, others corrected Disabling Mroonga engine for i686 architecture, as it is not supported by MariaDB Removed patches: fixed by upstream Patch5:...

Fedora 25 : perl-File-Path (2017-dd42592f9a)

This release fixes a possible setting arbitrary mode on an arbitrary file in rmtree and removetree calls known as CVE-2017-6512. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically...

Debian DLA-986-1 : zookeeper security update

It was discovered that Zookeeper, a service for maintaining configuration information, didn't restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption. This update disables those two commands by default. The new...

Easy File Sharing Web Server 7.2 - POST Buffer Overflow (DEP Bypass) Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python Exploit Title: Easy File Sharing Web Server 7.2 - 'POST' Buffer Overflow DEP Bypass with ROP Exploit Author: bl4ck h4ck3r Software Link: http://www.sharing-file.com/efssetup.exe Version: Easy File Sharing Web Server v7.2...

Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3315-1)

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information, spoof the addressbar contents, or execute...

Debian DLA-985-1 : libsndfile security update

It was discovered that there was a vulnerability in libsndfile, a library for reading/writing audio files. A specially crafted AIFF 'Audio Interchange File Format' file could result in an out-of-bounds memory read. For Debian 7 'Wheezy', this issue has been fixed in libsndfile version...

Microsoft Windows Graphics Component CVE-2017-0286 Information Disclosure Vulnerability

Description Microsoft Windows is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Technologies Affected Microsoft Office 2007 Service Pack 3 Microsoft Office 2010 Service Pack 2 32-bit...

Business Process Compromise: The Next Step in Advanced Targeted Attacks

Targeted attacks have come a long way in recent years, leveraging increasingly advanced techniques aimed at specific individuals. Often, these hackers pinpoint a single person within an enterprise, steal their credentials, log into an account, and leverage this position to find sensitive...

Blinking Router LEDs Leak Data From Air-Gapped Networks

Researchers have uncovered a new data extraction hole inside air-gapped networks that takes advantage of the blinking LED lights on top of routers to steal data. In a report published last week, researchers at Ben-Gurion University in Israel demonstrated how a router or switch running malware...

Please stop posting your X-rays to social media

Social media is fun. Posting pictures and sharing them with friends is a great technology. But please, we beg you, stop posting your medical imaging results to Instagram, Twitter, and Facebook. Why? What if you get a gnarly fracture from a really awesome snowboarding stunt and you want to share...

[SECURITY] [DSA 3874-1] ettercap security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3874-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 09, 2017 https://www.debian.org/security/faq -...

EulerOS 2.0 SP2 : nss (EulerOS-SA-2017-1109)

According to the version of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A null pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application...

EFS Easy Chat Server 3.1 - Remote Buffer Overflow (SEH)

Exploit Title: Easy Chat Server User Registeration Buffer Overflow SEH Date: 09/10/2017 Software Link: http://echatserver.com/ecssetup.exe Exploit Author: Aitezaz Mohsin Vulnerable Version: v2.0 to v3.1 Vulnerability Type: Buffer Overflow Severity: Critical Tested on: Windows XP Sp3 Eng...

EulerOS 2.0 SP1 : openjpeg (EulerOS-SA-2017-1088)

According to the versions of the openjpeg package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause...

EulerOS 2.0 SP1 : ghostscript (EulerOS-SA-2017-1100)

According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a...

Debian DLA-980-1 : ming security update

It was found that ming, a library to parse and generate SWF Flash files, is susceptible to an integer overflow that would lead into out of bound memory writes via a maliciously crafted file. For Debian 7 'Wheezy', these problems have been fixed in version 1:0.4.4-1.1+deb7u3. We recommend that you...