[SECURITY] [DLA 221-1] tiff security update

Package : tiff Version : 3.9.4-5+squeeze12 CVE ID : CVE-2014-8128 CVE-2014-8129 CVE-2014-9330 CVE-2014-9655 Debian Bug : 773987 Several vulnerabilities have been discovered in the LibTIFF library and utilities for the Tag Image File Format. These could lead to a denial of service, information...

Codoforum Filtering Feature Directory Traversal Vulnerability

Codoforum is a forum application. The Codoforum filter function fails to properly handle user-submitted PATH parameters, allowing attackers to perform directory traversal attacks and read the contents of arbitrary system files...

RESTEasy: XXE via parameter entities

It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible...

UBUNTU-CVE-2015-1225

PDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service out-of-bounds read via unspecified vectors...

UBUNTU-CVE-2014-0227

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks...

Ubuntu 14.04 LTS : GNU binutils vulnerabilities (USN-2496-1)

"The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2496-1 advisory. Michal Zalewski discovered that the setupgroup function in libbfd in GNU binutils did not properly check group headers in ELF files. An attacker could u...

USN-2496-1: GNU binutils vulnerabilities

Michal Zalewski discovered that the setupgroup function in libbfd in GNU binutils did not properly check group headers in ELF files. An attacker could use this to craft input that could cause a denial of service application crash or possibly execute arbitrary code. CVE-2014-8485 Hanno Böck...

PYSEC-2015-6

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service memory consumption via a long line in a file...

SysAid On-Premise Absolute Path Traversal Vulnerability

SysAid On-Premise is a data delivery software that supports on-premise storage of enterprise data in a suite of Web-based IT service management solutions from the U.S. company SysAid. An absolute path traversal vulnerability exists in SysAid On-Premise versions prior to 14.4.2 that allows remote...

Adobe Flash Player Regular Expression Object Out-Of-Bound Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose arbitrary memory on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within Regular Expressio...

imagemagic DoS

Out-of-buffer reads...

USN-2366-1 libvirt vulnerabilities

Daniel P. Berrange and Richard Jones discovered that libvirt incorrectly handled XML documents containing XML external entity declarations. An attacker could use this issue to cause libvirtd to crash, resulting in a denial of service on all affected releases, or possibly read arbitrary files if...

USN-2278-1 file vulnerabilities

Mike Frysinger discovered that the file awk script detector used multiple wildcard with unlimited repetitions. An attacker could use this issue to cause file to consume resources, resulting in a denial of service. CVE-2013-7345 Francisco Alonso discovered that file incorrectly handled certain CDF...

CGI-World Poll It 2.0 Internal Variable Override Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1431/info Poll It is a Perl CGI application used to create and maintain opinion polls on websites. The program relies on a number of internal variables. These variables can be overwritten by any remote user by specifying...

openSUSE Security Update : MozillaThunderbird / seamonkey (openSUSE-SU-2014:0584-1)

Mozilla Thunderbird was updated to 24.4.0. Mozilla SeaMonkey was updated to 2.25. - MFSA 2014-15/CVE-2014-1493/CVE-2014-1494 Miscellaneous memory safety hazards - MFSA 2014-17/CVE-2014-1497 bmo966311 Out of bounds read during WAV file decoding - MFSA 2014-18/CVE-2014-1498 bmo935618...

[SECURITY] [DSA 2918-1] iceweasel security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2918-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 30, 2014 http://www.debian.org/security/faq -...

DSA-2918-1 iceweasel - security update

Bulletin has no description...

Debian Security Advisory DSA 2918-1 (iceweasel - security update)

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows, missing permission checks, out of bound reads, use-after-frees and other implementation errors may lead to the execution of arbitrary code,...

Framework: XML External Entity (XXE) injection flaw

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in...

Debian DSA-2881-1 : iceweasel - security update

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, out of bound reads, use-after-frees and other implementation errors may lead to the execution of arbitrary code, information disclosure, denial of service...