FreeBSD : php-phar -- multiple vulnerabilities (8b1f53f3-2da5-11e5-86ff-14dae9d210b8)

reports : Segfault in Phar::convertToData on invalid file. Buffer overflow and stack smashing error in pharfixfilepath. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018...

Updated php package fixes security vulnerability

Incorrect handling of paths with NULs CVE-2015-4598. OS command injection vulnerability in escapeshellarg CVE-2015-4642. Integer overflow in ftpgenlist resulting in heap overflow CVE-2015-4643. Segfault in phppgsqlmetadata CVE-2015-4644. PHP has been updated to version 5.5.26, which fixes multipl...

php-phar -- multiple vulnerabilities

reports: Segfault in Phar::convertToData on invalid file. Buffer overflow and stack smashing error in pharfixfilepath...

php5 -- multiple vulnerabilities

The PHP project reports: DOM and GD: Fixed bug 69719 Incorrect handling of paths with NULs. FTP: Improved fix for bug 69545 Integer overflow in ftpgenlist resulting in heap overflow. CVE-2015-4643 Postgres: Fixed bug 69667 segfault in phppgsqlmetadata. CVE-2015-4644...

Fedora 20 : php-5.5.23-1.fc20 (2015-4216)

19 Mar 2015, PHP 5.5.23 Core : - Fixed bug 69174 leaks when unused inner class use traits precedence. Laruence - Fixed bug 69139 Crash in gczvalpossibleroot on unserialize. Laruence - Fixed bug 69121 Segfault in getcurrentuser when script owner is not in passwd with ZTS build. dan at syneto dot n...

Fedora 21 : php-5.6.7-1.fc21 (2015-4236)

19 Mar 2015, PHP 5.6.7 Core : - Fixed bug 69174 leaks when unused inner class use traits precedence. Laruence - Fixed bug 69139 Crash in gczvalpossibleroot on unserialize. Laruence - Fixed bug 69121 Segfault in getcurrentuser when script owner is not in passwd with ZTS build. dan at syneto dot ne...

Mandriva Linux Security Advisory : patch (MDVSA-2015:138)

Updated patch package fixes security vulnerabilities : It was reported that a crafted diff file can make patch eat memory and later segfault CVE-2014-9637. It was reported that the versions of the patch utility that support Git-style patches are vulnerable to a directory traversal flaw. This coul...

Fedora 22 : php-5.6.7-2.fc22 (2015-4255)

19 Mar 2015, PHP 5.6.7 Core : - Fixed bug 69174 leaks when unused inner class use traits precedence. Laruence - Fixed bug 69139 Crash in gczvalpossibleroot on unserialize. Laruence - Fixed bug 69121 Segfault in getcurrentuser when script owner is not in passwd with ZTS build. dan at syneto dot ne...

Debian DLA-130-1 : firebird2.1 security update

Segfault in server caused by malformed network packet. See: http://tracker.firebirdsql.org/browse/CORE-4630 NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as...

Fedora 21 : e2fsprogs-1.42.12-3.fc21 (2015-2511)

Fix potential buffer overflow in closefs 1193947, CVE-2015-1572 - Fix dumpe2fs segfault with no arguments 1194063 - Don't require fsck prior to resize2fs -P 1170803 Changes e2fsck.conf so that for filesystems with time-based check intervals set in the superblock, these time-based checks will work...

Fedora 21 : libvirt-1.2.9.2-1.fc21 (2015-1892)

Rebased to version 1.2.9.2 - CVE-2014-8131: deadlock and segfault in qemuConnectGetAllDomainStats bz 1172571 - CVE-2015-0236: missing ACL check for the VIRDOMAINXMLSECURE flag in save images and snapshots objects bz 1185769 - CVE-2014-8136: local denial of service in qemu/qemudriver.c bz 1176179...

openSUSE Security Update : vorbis-tools (openSUSE-2015-114)

vorbis-tools was updated to fix one security issue. This security issue was fixed : - Segfault when trying to encode trivial raw input CVE-2014-9640. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

patch: multiple issues

CVE-2015-1196 directory traversal A directory traversal flaw was discovered that allows remote attackers to write to arbitrary files via a symlink attack in a patch file. This could allow an attacker to overwrite arbitrary files by applying a specially crafted patch, with the privileges of the...

[SECURITY] [DLA 130-1] firebird2.1 security update

Package : firebird2.1 Version : 2.1.3.18185-0.ds1-11+squeeze2 CVE ID : CVE-2014-9323 Segfault in server caused by malformed network packet. See: http://tracker.firebirdsql.org/browse/CORE-4630...

DLA-130-1 firebird2.1 - security update

Bulletin has no description...

openSUSE Security Update : libvirt (openSUSE-SU-2015:0008-1)

CVE-2014-8135: libvirt: local denial of service in storage driver 87b9437f-CVE-2014-8135.patch bsc910860 - CVE-2014-8136: libvirt: local denial of service in qemu driver 2bdcd29c-CVE-2014-8136.patch bsc910862 - CVE-2014-8131: Fix possible deadlock and segfault in qemuConnectGetAllDomainStats...

PT-2014-9023 · Imagemagick +2 · Imagemagick +2

Name of the Vulnerable Software and Affected Versions: ImageMagick affected versions not specified Description: The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault and application crash, via a crafted pnm file. Recommendations: At the moment, there is...

Apache HTTP Server mod_dav MERGE Request Denial of Service - Ver2 (CVE-2013-1896)

A denial of service vulnerability has been reported in the moddav component of Apache HTTP Server. The vulnerability is due to a NULL pointer dereference when processing a MERGE request with a URI whose source href points to a non-DAV configured URI. A remote attacker can send a crafted HTTP...

OracleVM 2.1 : udev (OVMSA-2009-0006)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-1185 udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space. - fix fo...

OracleVM 3.3 : rsyslog (OVMSA-2014-0030)

The remote OracleVM system is missing necessary patches to address critical security updates : - use setsid to get a controlling session and process group Orabug: 17346261 Todd Vierling - fix CVE-2014-3634 resolves: 1149148 - drop patch 5 which introduced a regression resolves: 927405 reverts:...