grub2 security, bug fix, and enhancement update

2.02-0.29.0.1 - Fix comparison in patch for 18504756 - Remove symlink to grub environment file during uninstall on EFI platforms bug 19231481 - update Oracle Linux certificates Alexey Petrenko - Put 'with' in menuentry instead of 'using' bug 18504756 - Use different titles for UEK and RHCK kernel...

applican vulnerable to script injection

Overview applican provided by Newphoria Corporation Inc. is a platform to build hybrid applications for both iOS and Android. applican is vulnerable to script injection due to an issue in processing SSID. Note that this vulnerability is different from JVN64625488. Kenta Suefusa and Tomonori Shiom...

JVN#71088919: applican vulnerable to script injection

applican provided by Newphoria Corporation Inc. is a platform to build hybrid applications for both iOS and Android. applican is vulnerable to script injection due to an issue in processing SSID. Impact When an application built using applican processes a specially crafted SSID, an arbitrary scri...

JVN#64625488: applican vulnerable to script injection

applican provided by Newphoria Corporation Inc. is a platform to build hybrid applications for both iOS and Android. applican is vulnerable to script injection due to an issue in proccessing URL. Impact When a user accesses a specially crafted URL through an application built using applican, an...

RedHat Update for nss, nss-util, and nspr RHSA-2015:1981-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Scientific Linux Security Update : nss, nss-util, and nspr on SL6.x, SL7.x i386/x86_64 (20151104)

A use-after-poison flaw and a heap-based buffer overflow flaw were found in the way NSS parsed certain ASN.1 structures. An attacker could use these flaws to cause NSS to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSS library...

nss, nss-util, and nspr security update

nspr 4.10.8-2 - Resolves: Bug 1269360 - CVE-2015-7183 - nspr: heap-buffer overflow in PLARENAALLOCATE can lead to crash under ASAN, potential memory corruption nss 3.19.1-5.0.1 - Added nss-vendor.patch to change vendor 3.19.1-5 - Rebuild against updated NSPR 3.19.1-4 - Sync up with the rhel-6.6...

[SECURITY] Fedora 23 Update: pacemaker-1.1.13-3.fc23

Pacemaker is an advanced, scalable High-Availability cluster resource manager for Corosync, CMAN and/or Linux-HA. It supports more than 16 node clusters with significant capabilities for managing resources and dependencies. It will run scripts at initialization, when machines go up or down, when...

JVN#48211537: Party Track SDK for iOS fails to verify server certificates

Party Track SDK for iOS provided by Adways Inc. fails to verify server certificates in encrypted HTTPS communications. According to the developer, in addition to communications by the SDK, communications by the application using NSURLConnection also fail to verify server certificates. Impact A...

Oracle: Security Advisory (ELSA-2012-0774)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

JVN#08494613: NScripter vulnerable to buffer overflow

NScripter is a script engine to build and execute games. NScripter contains a buffer overflow vulnerability due to a flaw in processing save data. Impact By processing a specially crafted save data, arbitrary code may be executed. Solution For developers using NScripter: Update and Rebuild the Ga...

Fedora 22 : spatialite-tools-4.2.0-10.fc22 / sqlite-3.8.9-1.fc22 (2015-6157)

Update of sqlite to latest upstream version, with spatialite-tools rebuild. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introduci...

LittleCMS: Denial of service

Background LittleCMS, or short lcms, is a color management system for working with ICC profiles. It is used by many applications including GIMP and Firefox. Description Multiple stack-based buffer overflows and a profile parser error have been found in LittleCMS. Impact A remote attacker could...

libxml2: Denial of service

Background libxml2 is the XML C parser and toolkit developed for the Gnome project. Description parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled. Impact A context-dependent attacker could entice a user to a specially craft...

SuSE 11.3 Security Update : compat-wireless, compat-wireless-debuginfo, etc (SAT Patch Number 9414)

This update for the compat-wireless kernel modules provides many fixes and enhancements : - Fix potential crash problem in ath9k. CVE-2014-2672, bnc871148 - Fix improper updates of MAC addresses in ath9khtc. bnc851426, CVE-2013-4579 - Fix stability issues in iwlwifi. bnc865475 - Improve support f...

Scientific Linux Security Update : curl on SL6.x i386/x86_64 (20140527)

It was found that libcurl could incorrectly reuse existing connections for requests that should have used different or no authentication credentials, when using one of the following protocols: HTTPS with NTLM authentication, LDAPS, SCP, or SFTP. If an application using the libcurl library connect...

Oracle Linux 6 : curl (ELSA-2014-0561)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0561 advisory. - fix re-use of wrong HTTP NTLM connection CVE-2014-0015 - fix connection re-use when using different log-in credentials CVE-2014-0138 Tenable has...

MGASA-2014-0162 Updated php packages fix security vulnerabilities

Updated php packages fix security vulnerabilities: It was discovered that the file utility contains a flaw in the handling of "indirect" magic rules in the libmagic library, which leads to an infinite recursion when trying to determine the file type of certain files CVE-2014-1943. A flaw was foun...

[ MDVSA-2014:014 ] php

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:014 http://www.mandriva.com/en/support/security/ Package : php Date : January 21, 2014 Affected: Business Server 1.0 Problem Description: Multiple vulnerabilities has been discovered and corrected in php: Th...

Incorrect values in the properties of objects in SCOM console

Challenge The collection of performance and events works fine, but during investigation of CPU/RAM properties of Hosts, Virtual Machines etc. unexpected values are revealed. For example ESXi host has 345.9 GB of RAM, but the SCOM property field contains 3459 GB. Cause SCOM processes these values...