file: out-of-bounds access in search rules with offsets from input file

A denial of service flaw was found in the way the File Information fileinfo extension handled search rules. A remote attacker could use this flaw to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU...

file: unrestricted regular expression matching

Multiple flaws were found in the File Information fileinfo extension regular expression rules for detecting various files. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to consume an excessive amount of CPU...

file: unrestricted regular expression matching

Multiple flaws were found in the File Information fileinfo extension regular expression rules for detecting various files. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to consume an excessive amount of CPU...

Incorrect implementation of NAT-PMP in multiple devices

Overview Many NAT-PMP devices are incorrectly configured, allowing them to field requests received on external network interfaces or map forwarding routes to addresses other than that of the requesting host, making them potentially vulnerable to information disclosure and malicious port mapping...

[SECURITY] [DLA 73-1] tzdata update

Package : tzdata Version : 2014h-0squeeze1 Upstream published version 2014h. Changes since 2014e-0squeeze1 currently in squeeze are adjustments to the DST rules of Russia and a timezone change for Turks & Caicos. Aurelien Jarno GPG: 4096R/1DDD8C9B [email protected] http://www.aurel32.net...

DLA-73-1 tzdata - update

Bulletin has no description...

file, python security update

CentOS Errata and Security Advisory CESA-2014:1606 Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS...

Information disclosure

The Russian Federation Traffic Rules aka com.russia.pdd application 1.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7392

The Russian Federation Traffic Rules aka com.russia.pdd application 1.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7392

The CVE refers to the Android app Russian Federation Traffic Rules (com.russia.pdd), version 1.21, which does not verify X.509 certificates from SSL servers. This misconfiguration allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The u...

CVE-2014-7392: Undefined Security Weakness

The Russian Federation Traffic Rules aka com.russia.pdd application 1.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

file: unrestricted recursion in handling of indirect type rules

A denial of service flaw was found in the way the File Information fileinfo extension handled indirect rules. A remote attacker could use this flaw to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU...

file: out-of-bounds access in search rules with offsets from input file

A denial of service flaw was found in the way the File Information fileinfo extension handled search rules. A remote attacker could use this flaw to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU...

Amazon Linux AMI : mod24_security (ALAS-2014-334)

apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

CVE-2014-6603

The SSHParseBanner function in SSH parser app-layer-ssh.c in Suricata before 2.0.4 allows remote attackers to bypass SSH rules, cause a denial of service crash, or possibly have unspecified other impact via a crafted banner, which triggers a large memory allocation or an out-of-bounds write...

CVE-2014-6603

The SSHParseBanner function in SSH parser app-layer-ssh.c in Suricata before 2.0.4 allows remote attackers to bypass SSH rules, cause a denial of service crash, or possibly have unspecified other impact via a crafted banner, which triggers a large memory allocation or an out-of-bounds write...

CVE-2014-6603

The SSHParseBanner function in SSH parser app-layer-ssh.c in Suricata before 2.0.4 allows remote attackers to bypass SSH rules, cause a denial of service crash, or possibly have unspecified other impact via a crafted banner, which triggers a large memory allocation or an out-of-bounds write...

PT-2014-7297

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 2.0.4 Description The issue allows remote attackers to bypass SSH rules, cause a denial of service crash, or possibly have unspecified other impact via a crafted banner. This is triggered by the SSHParseBanner functi...

The latest Bash vulnerability patch Junior programme-vulnerability warning-the black bar safety net

Bash broke the remote parsing command execution vulnerability, CVE-2 0 1 4-6 2 7 1, the spread of major Linux distributions and MacOSX systems. Vulnerability can be directly in the Bash support the Web CGI environment remote execution of arbitrary commands. bash is injected after the public...

CVE-2014-4793

IBM WebSphere MQ 8.x before 8.0.0.1 does not properly enforce CHLAUTH rules for blocking client connections in certain circumstances related to the CONNAUTH attribute, which allows remote authenticated users to bypass intended queue-manager access restrictions via unspecified vectors...