libvncserver: server divide-by-zero flaw in scaling factor handling

A divide-by-zero flaw was found in the way LibVNCServer handled the scaling factor when it was set to "0". A remote attacker could use this flaw to crash the VNC server using a malicious VNC client...

libvncserver: server NULL pointer dereference flaw in ClientCutText message handling

A NULL pointer dereference flaw was found in the way LibVNCServer handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client...

openSUSE Security Update : pidgin (openSUSE-SU-2014:1376-1)

The following issues were fixed in this update : + General : - Check the basic constraints extension when validating SSL/TLS certificates. This fixes a security hole that allowed a malicious man-in-the-middle to impersonate an IM server or any other https endpoint. This affected both the NSS and...

DEBIAN-CVE-2013-0336

The ipapwdchpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwdextop.c in the directory server dirsrv in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service crash via a connection request without a username/dn, related to the 389 directory server...

file: incomplete fix for CVE-2012-1571 in cdf_read_property_info

It was found that the fix for CVE-2012-1571 was incomplete; the File Information fileinfo extension did not correctly parse certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file...

asterisk -- Remote Crash Vulnerability in WebSocket Server

The Asterisk project reports: When handling a WebSocket frame the reshttpwebsocket module dynamically changes the size of the memory used to allow the provided payload to fit. If a payload length of zero was received the code would incorrectly attempt to resize to zero. This operation would succe...

[slackware-security] pidgin (SSA:2014-296-02)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security pidgin SSA:2014-296-02 New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+...

[slackware-security] pidgin

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: pidgin-2.10.10-i486-1slack14.1.txz: Upgraded. This update fixes several security issues: Insufficient SSL certificate...

wireshark: DOS Sniffer file parser flaw (wnpa-sec-2014-19)

Buffer overflow in the SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service application crash via a crafted file that triggers writes of uncompressed bytes...

wireshark: SES dissector crash (wnpa-sec-2014-18)

The dissectspdu function in epan/dissectors/packet-ses.c in the SES dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not initialize a certain ID value, which allows remote attackers to cause a denial of service application crash via a crafted packet...

wireshark: DOS Sniffer file parser flaw (wnpa-sec-2014-19)

The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not validate bitmask data, which allows remote attackers to cause a denial of service application crash via a crafted file...

Oracle Linux 6 : krb5 (ELSA-2014-1389)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1389 advisory. - incorporate fix for MITKRB5-SA-2014-001 CVE-2014-4345, 1128157 - gssapi: pull in upstream fix for a possible NULL dereference in spnego CVE-2014-4344...

DEBIAN-CVE-2014-8240

Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service crash and possibly execute arbitrary code via vectors related to screen size handling, which triggers a heap-based buffer overflow, a similar issue to CVE-2014-6051...

RedHat Update for krb5 RHSA-2014:1389-02

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2014-6051

Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service crash and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow...

file: incomplete fix for CVE-2012-1571 in cdf_read_property_info

It was found that the fix for CVE-2012-1571 was incomplete; the File Information fileinfo extension did not correctly parse certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file...

openssl: DTLS packet processing double free

A flaw was discovered in the way OpenSSL handled DTLS packets. A remote attacker could use this flaw to cause a DTLS server or client using OpenSSL to crash or use excessive amounts of memory...

Fedora 21 : knot-1.5.2-1.fc21 (2014-10507)

New upstream release : - CVE-2014-0486: remote crash using crafted DNS message - transfers: do not refuse AXFR answers to IXFR queries - fix storing of hash character '' in zone file Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...

Fedora 19 : asterisk-11.10.2-2.fc19 (2014-7570)

The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The available security releases are released as versions 1.8.15-cert7, 11.6-cert4, 1.8.28.2, 11.10.2, and 12.3.2. These releases are available for immediate download at...

AST-2014-010: Remote crash when handling out of call message in certain dialplan configurations

Asterisk Project Security Advisory - AST-2014-010 Product Asterisk Summary Remote crash when handling out of call message in certain dialplan configurations Nature of Advisory Remotely triggered crash of Asterisk Susceptibility Remote authenticated sessions Severity Minor Exploits Known No Report...