[SECURITY] Fedora 23 Update: nodejs-ws-1.0.1-1.fc23

Simple to use, blazing fast and thoroughly tested web socket client, server and console for nodejs, up-to-date against RFC-6455...

What the heck is RFC 5114?

Mandatory Disclaimer: IANAC I am not a cryptographer so I might likely end up writing a bunch of mistakes in this blog post... I already talked about Diffie–Hellman DH from now on in TLS in my previous post: Small subgroup attack in Mozilla NSS. As mentioned FWIW I strongly agree with Google Chro...

CentOS 7 : unbound (CESA-2015:2455)

Updated unbound packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

unbound security update

CentOS Errata and Security Advisory CESA-2015:2455 Updated unbound packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base...

EMC Isilon OneFS privilege elevation Vulnerability(CVE-2 0 1 5-6 8 4 8)-vulnerability warning-the black bar safety net

CVECAN ID: CVE-2 0 1 5-6 8 4 8 EMC Isilon OneFS Operating System is a collection of File System, Volume Manager and data protection in one smart file system. EMC Isilon OneFS in the realization on the presence of Privilege escalation vulnerabilities, if the RFC 2 3 0 7 on the cluster is enabled a...

CVE-2015-6848

EMC Isilon OneFS vulnerability (CVE-2015-6848) affects Isilon 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1. When RFC 2307 is configured but SFU is not universally present, remote authenticated AD users can obtain root privileges via unspecified vectors. The underlying ...

Proftpd堆溢出漏洞

=========================== VULNERABILITIES =========================== ../proftpd-master/src/pool.c:89-116 Heap Overflow due to zero length malloc allocation TYPE: CERT MEM04-C; CWE-131 Code Snippet: ............................ ret = mallocsize; if ret == NULL prlogpriPRLOGALERT, "Out of...

RedHat Update for unbound RHSA-2015:2455-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Low: Red Hat Security Advisory: unbound security and bug fix update

Updated unbound packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RedHat Update for libreswan RHSA-2015:1979-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS Update for libreswan CESA-2015:1979 centos7

Check the version of libreswan SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882312";...

RHEL 7 : libreswan (RHSA-2015:1979)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2015:1979 advisory. Libreswan is an implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both...

Moderate: Red Hat Security Advisory: libreswan security and enhancement update

Updated libreswan packages that fix one security issue, several bugs, and add several enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which give...

Oracle Linux 7 : libreswan (ELSA-2015-1979)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2015-1979 advisory. - Resolves: rhbz1259208 CVE-2015-3240 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus h...

[SECURITY] Fedora 23 Update: opensmtpd-5.7.3p1-1.fc23

OpenSMTPD is a FREE implementation of the server-side SMTP protocol as defi ned by RFC 5321, with some additional standard extensions. It allows ordinary machines to exchange e-mails with other systems speaking the SMTP protocol. Started out of dissatisfaction with other implementations, OpenSMTP...

Re: CVE-2015-5204: HTTP header injection vulnerability in Apache Cordova File Transfer Plugin for Android

CVE-2015-5204: HTTP header injection vulnerability in Apache Cordova File Transfer Plugin for Android Severity: Medium Vendor: The Apache Software Foundation Versions Affected: Cordova Android File Transfer Plugin 1.2.1 and below Description: Android applications built with the Cordova framework...

[SECURITY] Fedora 22 Update: opensmtpd-5.7.3p1-1.fc22

OpenSMTPD is a FREE implementation of the server-side SMTP protocol as defi ned by RFC 5321, with some additional standard extensions. It allows ordinary machines to exchange e-mails with other systems speaking the SMTP protocol. Started out of dissatisfaction with other implementations, OpenSMTP...

DHS Alerts to Continuing Browser Cookie Vulnerabilities

In case didn’t know or need a reminder, browser cookies aren’t exactly impervious to attack. The DHS-sponsored CERT at the Software Engineering Institute at Carnegie Mellon University this week dropped an alert that warns users about the continued prevalence of a class of cookie vulnerabilities...

Exploiting Browser Cookies to Bypass HTTPS and Steal Private Information

A newly discovered critical flaw in the implementation of web cookies by major browsers could open secured HTTPS browsing to Man-in-the-middle attacks. The US Computer Emergency Response Team CERT has revealed that all the main browser vendors have improperly implemented the RFC 6265 Standard, al...

Cookies set via HTTP requests may be used to bypass HTTPS and reveal private information

Overview RFC 6265 previously RFC 2965 established HTTP State Management, also known as "cookies". In most web browser implementations of RFC 6265, cookies set via HTTP requests may allow a remote attacker to bypass HTTPS and reveal private session information. Description HTTP cookies have long...