gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack

Werner Koch reports: CVE-2013-4576 has been assigned to this security bug. The paper describes two attacks. The first attack allows to distinguish keys: An attacker is able to notice which key is currently used for decryption. This is in general not a problem but may be used to reveal the...

MGASA-2013-0354 Updated gnutls package fixes security vulnerability

A DNS server that returns more 4 DANE entries could corrupt the memory of a requesting client using the DANE library from GnuTLS before 3.1.15 and 3.2.5 CVE-2013-4466. This updates GnuTLS to version 3.1.16, fixing this issue and several other bugs...

PineApp MailSecure - Remote Command Execution Vulnerability

Exploit for linux platform in category remote exploits ----------------------------------------------------------------- It is possible execute any command bash as qmailq unprivilege user, sending only the following https request, without authentication...

Dede background getshell【2 0 1 3 0 7 1 5】-bug warning-the black bar safety net

The test version is: V5. 7 2 0 1 3 0 7 1 5 Test steps: Background-the SQL command to run-execute the command | 1 | INSERT INTO dedemyad aid, clsid, typeid, tagname, adname, timeset, starttime, endtime, normbody, expbody VALUES ---|--- 2 | 2 0 0 0, 0, 0, 'indexTopBanner1', 'home page top navigatio...

php53 security, bug fix and enhancement update

5.3.3-21 - add security fix for CVE-2013-4248 5.3.3-20 - add security fix for CVE-2013-4113 5.3.3-19 - add upstream reproducer for errorhandler 951075 5.3.3-18 - add security fixes for CVE-2006-7243 5.3.3-17 - reorder security patches - add security fixes for CVE-2012-2688, CVE-2012-0831,...

Sql Injection in "2easy Web Applications"

Hi! I have discovered a sql injection bug in "2easy Web Applications". vendor: http://www.2easy.gr/ bug in: readText.asp?textID= live examples: http://www.mroe.org/en/readText.asp?textID=223 http://www.ananeotiki.gr/el/readText.asp?textID=7078 http://www.vpg.nu/sv/readText.asp?textID=8 and so on...

MikroTik RouterOS - sshd (ROSSSH) Remote Heap Corruption

During an audit the Mikrotik RouterOS sshd ROSSSH has been identified to have a remote previous to authentication heap corruption in its sshd component. Exploitation of this vulnerability will allow full access to the router device. This analysis describes the bug and includes a way to get...

CVE-2013-4124 samba nttrans dos private exploit

Hi Forks! It's my samba private exploit and article of it. the security bug occurs while nttrans reply in samba daemon source code tree. the remote dos exploit that i copied from another nttrans exploit in 2003. and can't test it yet, check it out! CVE-2013-4124 samba dos private exploit: -...

Samba 3.5.223.6.174.0.8 - nttrans Reply Integer Overflow

Samba 3.5.223.6.174.0.8 - nttrans Reply Integer Overflow Exploitation: samba nttrans reply integer overflow / \ / \ | || | | | \ / / . || | | | / | handlenttrans +- callnttransactcreate // transact! - readnttrnsealistvulnerable function security bug analyze smbd/nttrans.c ---- snip ---- snip ----...

Mozilla Firefox 3.6 - Integer Overflow Exploit

This exploit leverages WOFF heap corruption due to an integer overflow in Mozilla Firefox versions 3.6, 3.6 Beta 1, 3, 4, and 5, 3.6 RC1 and RC2. include include include include / x90c WOFF 1day exploit MFSA2010-08 WOFF Heap Corruption due to Integer Overflow 1day exploit CVE-ID: CVE-2010-1028 Fu...

Linux Kernel 'MSR' Driver Local Privilege Escalation

Exploit for linux platform in category local exploits // PoC exploit for /dev/cpu//msr, 32bit userland on a 64bit host // can do whatever in the commented area, re-enable module support, etc // requires CONFIGX86MSR and just uid 0 // a small race exists between the time when the MSR is written to...

Fedora 17 : fdupes-1.51-1.fc17 (2013-13202)

Upstream - Added support for 64-bit file offsets on 32-bit systems. - Using tty for interactive input instead of regular stdin. This is to allow feeding filenames via stdin in future versions of fdupes without breaking interactive deletion feature. - Fixed some typos in --help. - Turned C++ style...

Nikon CoolPix L Series Fw1.0 - Information Disclosure Bug

Document Title: =============== Nikon CoolPix L Series Fw1.0 - Information Disclosure Bug References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1014 Release Date: ============= 2013-07-15 Vulnerability Laboratory ID VL-ID: ====================================...

Oracle Linux 3 / 4 : evolution (ELSA-2007-0509)

From Red Hat Security Advisory 2007:0509 : Updated evolution packages that fix a security bug are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having important security impact by the Red Hat Security Response Team. Evolution is the GNOME collection of personal...

Oracle Linux 3 / 4 : evolution (ELSA-2007-0353)

From Red Hat Security Advisory 2007:0353 : Updated evolution packages that fix a security bug are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Evolution is the GNOME collection of personal...

Oracle Linux 5 : Unbreakable Enterprise kernel (ELSA-2010-2009)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-2009 advisory. - rds fix access issue with rds Chris Mason CVE-2010-3904 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Google Chrome 25.0.1364.152 HTTP Referer Header Faking

Advisory: XMLHttpRequest HTTP Referer Header Faking Author: Liad Mizrachi Vendor URL: http://www.chromium.org/ Vulnerability Status: Fixed Application Version: Google Chrome v25.0.1364.152 ========================== Vulnerability Description ========================== Chromium is the open source...

APK duplicate file

Android does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file APK that is modified in a way that does not violate the cryptographic signature. Android security bug 8219321...

Microsoft PowerPoint 2007 - Crash (PoC)

Microsoft PowerPoint 2007 - Crash PoC Title : Microsoft Office PowerPoint 2007 Crash PoC Date: 2013-01-12 Software Link: http://office.microsoft.com/ Author: Asesino04 Tested on: Windows XP SP2 Special Thanks To : Ness Oum El Bouaghi Bug Description: when you insert a sound to Microsoft office...

Google Chrome Inbuilt Flash player allows Webcam Hacking

No longer limited to Hollywood movies about cybercrime, webcam hacking has stealthily and aggressively broken into average households "I've heard a hacker could access my webcam and watch me in front of my computer. Could this really happen?" YES, other than using a Remote administration tools, i...