squid security and bug fix update

7:3.1.10-16 - Resolves: 888198 - CVE-2012-5643: improved upstream patch 7:3.1.10-15 - Reverts: 861062 - Squid delays on FQDNs that don't contains AAAA record 7:3.1.10-14 - Resolves: 888198 - CVE-2012-5643: patch 7:3.1.10-13 - Resolves: 888198 - CVE-2012-5643: DoS excessive resource consumption...

Mandriva Linux Security Advisory : squid (MDVSA-2013:013)

Multiple vulnerabilities has been found and corrected in squid cachemgr.cgi : Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service memory consumption via 1...

CVE-2013-0269

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service resource consumption or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain...

CVE-2013-0269 rubygem-json: Denial of Service and SQL Injection

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service resource consumption or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain...

CVE-2013-0269

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service resource consumption or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain...

Design/Logic Flaw

cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service resource consumption via a crafted request. NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or...

CVE-2013-0189

Squid vulnerability CVE-2013-0189 affects cachemgr.cgi in Squid 3.1.x and 3.2.x (potentially 3.1.22, 3.2.4, and other versions). The issue stems from an incomplete fix for CVE-2012-5643, possibly due to an incorrect order of arguments or incorrect comparison, allowing remote attackers to cause a ...

CVE-2013-0189

cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service resource consumption via a crafted request. NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or...

CVE-2012-5977

Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones, when anonymous calls are enabled, allow remote attackers to cause a denial of service...

CVE-2012-5977

Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones, when anonymous calls are enabled, allow remote attackers to cause a denial of service...

Design/Logic Flaw

Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones, when anonymous calls are enabled, allow remote attackers to cause a denial of service...

CVE-2012-5977

CVE-2012-5977 affects Asterisk Open Source 1.8.x <1.8.19.1, 10.x <10.11.1, 11.x <11.1.2 and Certified Asterisk 1.8.11<1.8.11-cert10, plus Asterisk Digiumphones 10.x=1.8.19.1, 10.x >=10.11.1, or 11.x >=11.1.2 (as applicable). Exploitation details or in-the-wild status are not pro...

CVE-2012-5977

Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones, when anonymous calls are enabled, allow remote attackers to cause a denial of service...

CVE-2012-5977

Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones, when anonymous calls are enabled, allow remote attackers to cause a denial of service...

squid -- denial of service

Squid developers report: Due to missing input validation Squid cachemgr.cgi tool is vulnerable to a denial of service attack when processing specially crafted requests. This problem allows any client able to reach the cachemgr.cgi to perform a denial of service attack on the service host. The...

Siemens Automation License Manager Uncontrolled Resource Consumption

Overview This advisory provides mitigation details for a vulnerability that impacts the Siemens Automation License Manager ALM. Siemens ProductCERT has identified an uncontrolled resource consumption vulnerabilitySSA-783261, https://cert-portal.siemens.com/productcert/pdf/ssa-783261.pdf, Web site...

Debian Security Advisory DSA 2563-1 (viewvc)

The remote host is missing an update to viewvc announced via advisory DSA 2563-1. OpenVAS Vulnerability Test $Id: deb25631.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2563-1 viewvc Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Debian DSA-2563-1 : viewvc - several vulnerabilities

Several vulnerabilities were found in ViewVC, a web interface for CVS and Subversion repositories. - CVE-2009-5024 Remote attackers can bypass the cvsdb rowlimit configuration setting, and consequently conduct resource-consumption attacks via the limit parameter. - CVE-2012-3356 The remote...

Wireshark 1.8.x < 1.8.3 Multiple Vulnerabilities

The installed version of Wireshark 1.8 is earlier than 1.8.3. It thus is affected by the following vulnerabilities : - A malformed packet can cause the 'DRDA' and 'HSRP' dissectors to enter an infinite loop, thereby consuming excessive CPU resources. CVE-2012-3548, CVE-2012-5237 - A malformed...

CVE-2012-3300

IBM WebSphere Commerce 7.0 before 7.0.0.6, when persistent sessions and personalization IDs are enabled, allows remote attackers to cause a denial of service resource consumption via unspecified vectors...