kernel: net: Fix memory leak/corruption on VLAN GRO_DROP

The Generic Receive Offload GRO implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization RHEV Hypervisor and other products, allows remote attackers to cause a denial of service via crafted VLAN...

PT-2011-1063 · Red Hat +2 · Red Hat +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 2.6.18 through 2.6.32 Red Hat Enterprise Linux 5 and 6 affected versions not specified Description: The issue allows remote attackers to cause a denial of service via crafted VLAN packets that are processed by the napi...

PHP <5.3.7 substr_replace()释放后重用拒绝服务漏洞

No description provided by source...

kernel: gro: reset dev and skb_iff on skb reuse

The napireuseskb function in net/core/dev.c in the Generic Receive Offload GRO implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service NULL pointer dereference via a malformed VLAN fra...

kernel: gro: reset dev and skb_iff on skb reuse

The napireuseskb function in net/core/dev.c in the Generic Receive Offload GRO implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service NULL pointer dereference via a malformed VLAN fra...

PT-2011-1062 · Suse +2 · Ext4Dev-Kmp-Trace +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.38 Description: The issue is related to the Generic Receive Offload GRO implementation in the Linux kernel. A problem in the napi reuse skb function in net/core/dev.c does not reset the values of certain...

FreeBSD : tarsnap -- cryptographic nonce reuse (2c2d4e83-2370-11e0-a91b-00e0815b8da8)

Colin Percival reports : In versions 1.0.22 through 1.0.27 of Tarsnap, the CTR nonce value is not incremented after each chunk is encrypted. The CTR counter is correctly incremented after each 16 bytes of data was processed, but this counter is reset to zero for each new chunk. Note that since th...

openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG ciphersuite downgrade attack

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSLOPNETSCAPEREUSECIPHERCHANGEBUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network...

DEBIAN-CVE-2010-4180

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSLOPNETSCAPEREUSECIPHERCHANGEBUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network...

System: SCEP one-time PIN reuse

Red Hat Certificate System RHCS 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN...

DEBIAN-CVE-2010-3075

EncFS before 1.7.0 encrypts multiple blocks by means of the CFB cipher mode with the same initialization vector, which makes it easier for local users to obtain sensitive information via calculations involving recovery of XORed data, as demonstrated by an attack on encrypted data in which the las...

tomcat: information leak vulnerability in the handling of 'Transfer-Encoding' header

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service application outage or obtain sensitive information via a crafted header that interferes with "recycling...

FreeBSD : mozilla -- multiple vulnerabilities (99858b7c-7ece-11df-a007-000f20797ede)

Mozilla Project reports : MFSA 2010-33 User tracking across sites using Math.random MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present MFSA 2010-31 focus behavior can be used to inject or steal keystrokes MFSA 2010-30 Integer Overflow in XSLT Node Sorting...

Mozilla Foundation Security Advisory 2010-28

Mozilla Foundation Security Advisory 2010-28 Title: Freed object reuse across plugin instances Impact: Critical Announced: June 22, 2010 Reporter: Microsoft Vulnerability Research Products: Firefox, SeaMonkey Fixed in: Firefox 3.6.4 Firefox 3.5.10 SeaMonkey 2.0.5 Description Microsoft Vulnerabili...

Mozilla Firefox 3.6.x < 3.6.4 Multiple Vulnerabilities

Binary data 5580.prm...

Freed object reuse across plugin instances — Mozilla

Microsoft Vulnerability Research reported that two plugin instances could interact in a way in which one plugin gets a reference to an object owned by a second plugin and continues to hold that reference after the second plugin is unloaded and its object is destroyed. In these cases, the first...

Mozilla Foundation Security Advisory 2010-09

Mozilla Foundation Security Advisory 2010-09 Title: Deleted frame reuse in multipart/x-mixed-replace image Impact: Moderate Announced: March 23, 2010 Reporter: regenrecht via TippingPoint's Zero Day Initiative Products: Firefox 3.6 Fixed in: Firefox 3.6.2 Description Security researcher regenrech...

CVE-2010-1135

The userlogout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse...

Design/Logic Flaw

The userlogout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse...

CVE-2010-1135

The userlogout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse...