Condor任务提交绕过安全限制漏洞

BUGTRAQ ID: 37443 CVE ID: CVE-2009-4133 Condor是为计算密集任务所设计的专用负载管理系统，提供任务队列机制、调度策略、优先级规划和资源监控及管理。 Condor管理任务的方式存在漏洞，可能允许授权向Condor提交任务的用户以不同本地用户的身份排列任务，这可能导致非授权访问该用户的账号。Condor不会以root用户权限运行任务，因此这个漏洞不会导致入侵root用户账号。 Condor Project Condor 7.4 厂商补丁： RedHat ------...

CVE-2009-4143

PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to 1 interrupt corruption of the SESSION superglobal array and 2 the session.savepath directive...

firefox, xulrunner security update

CentOS Errata and Security Advisory CESA-2009:1674 Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open sour...

[security bulletin] HPSBMA02252 SSRT061258, SSRT061259 rev.1 - HP OpenView Storage Data Protector, Remote Arbitrary Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01124817 Version: 1 HPSBMA02252 SSRT061258, SSRT061259 rev.1 - HP OpenView Storage Data Protector, Remote Arbitrary Code Execution NOTICE: The information in this Security Bulletin should be acte...

RHEL 4 : xpdf (RHSA-2009:1680)

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2009:1680 advisory. Xpdf is an X Window System based viewer for Portable Document Format PDF files. Petr Gajdos and Christian Kornacker of SUSE reported a buffer overflo...

seamonkey security update

1.0.9-51.0.1.el48 - Added mozilla-oracle-default-prefs.js and mozilla-oracle-default-bookmarks.html and removed corresponding RedHat ones 1.0.9-51.el4 - Added fixes from 1.9.0.16...

RedHat Security Advisory RHSA-2009:1659

The remote host is missing updates announced in advisory RHSA-2009:1659. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for the standard Red Hat Enterprise Linux kernel. On x86 platforms, the doinsnfet...

RedHat Security Advisory RHSA-2009:1657

The remote host is missing updates announced in advisory RHSA-2009:1657. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. Multiple security flaws were found in the way Flash Player displayed certain SWF content. An attacker could use these fla...

JBoss企业应用平台多个安全漏洞

BUGTRAQ ID: 37276 CVE ID: CVE-2009-1380,CVE-2009-2405,CVE-2009-3554 JBoss企业应用平台（EAP）是J2EE应用的中间件平台。 JBoss的实现上存在多个安全漏洞，包括多个跨站脚本问题和一个本地信息泄露问题，远程攻击者可能利用此漏洞来窃取信息。 RedHat JBoss EAP 厂商补丁： RedHat ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.jboss.org/...

RedHat Security Advisory RHSA-2009:1651

The remote host is missing updates announced in advisory RHSA-2009:1651. The Network Time Protocol NTP is used to synchronize a computer's time with a referenced time source. Robin Park and Dmitri Vinokurov discovered a flaw in the way ntpd handled certain malformed NTP packets. ntpd logged...

RedHat Security Advisory RHSA-2009:1648

The remote host is missing updates announced in advisory RHSA-2009:1648. The Network Time Protocol NTP is used to synchronize a computer's time with a referenced time source. Robin Park and Dmitri Vinokurov discovered a flaw in the way ntpd handled certain malformed NTP packets. ntpd logged...

RedHat Security Advisory RHSA-2009:1646

The remote host is missing updates announced in advisory RHSA-2009:1646. GNU Libtool is a set of shell scripts which automatically configure UNIX, Linux, and similar operating systems to generically build shared libraries. A flaw was found in the way GNU Libtool's libltdl library looked for modul...

Adobe Reader and Acrobat 'newplayer()' JavaScript Method Remote Code Execution Vulnerability

Description Adobe Reader and Acrobat are prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code. Failed exploit attempts will likely cause denial-of-service conditions. This issue affects Reader and Acrobat 9.2 and prior versions. Technologies...

RedHat Security Advisory RHSA-2009:1648

The remote host is missing updates announced in advisory RHSA-2009:1648. The Network Time Protocol NTP is used to synchronize a computer SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holder...

RedHat Security Advisory RHSA-2009:1657

The remote host is missing updates announced in advisory RHSA-2009:1657. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. Multiple security flaws were found in the way Flash Player displayed certain SWF content. An attacker could use these fla...

RedHat Security Advisory RHSA-2009:1651

The remote host is missing updates announced in advisory RHSA-2009:1651. The Network Time Protocol NTP is used to synchronize a computer SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holder...

RedHat Security Advisory RHSA-2009:1658

The remote host is missing updates announced in advisory RHSA-2009:1658. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. Multiple security flaws were found in the way Flash Player displayed certain SWF content. An attacker could use these fla...

Dstat sys.path搜索路径本地权限提升漏洞

BUGTRAQ ID: 37131 CVECAN ID: CVE-2009-3894,CVE-2009-4081 Dstat是vmstat、iostat和netstat工具的多功能替代品，可用于性能调节测试、基准和故障排除等方面。 dstat在sys.path中包含有当前工作目录和profile子目录。如果本地用户在攻击者可写的目录（如/tmp）中运行了dstat且攻击者在该目录中放置了某些Python模块（如getopt.py），就可以导致以运行dstat用户的权限执行任意代码。 Dag Wiers dstat 0.6.9 厂商补丁： RedHat ------...

Adobe Flash Player JPEG解析堆溢出漏洞

BUGTRAQ ID: 37266 CVE ID: CVE-2009-3794 Flash Player是一款非常流行的FLASH播放器。 Flash Player在解析SWF文件中所包含的JPEG维度时计算图形的帧大小缺少过滤检查，用户受骗打开恶意的JPEG图形就可以触发堆溢出，导致执行任意代码。 Adobe Flash Player 10.x Adobe AIR 1.5.2 厂商补丁： Adobe ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://get.adobe.com/flashplayer/...

Adobe Flash Player ActionScript异常处理器整数溢出漏洞

BUGTRAQ ID: 37267 CVE ID: CVE-2009-3799 Flash Player是一款非常流行的FLASH播放器。 Flash Player在生成ActionScript异常处理器期间过大的exceptioncount值会在Verifier::parseExceptionHandlers函数中触发整数溢出，导致以当前登录用户的权限执行任意代码。 Adobe Flash Player 10.x Adobe AIR 1.5.2 厂商补丁： Adobe ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...