Fedora 25 : phpMyAdmin (2016-6576a8536b)

phpMyAdmin 4.6.5.1 2016-11-26 =============================== A patch-level release fixing two small issues : - an issue affecting a small number of users using $cfg'Servers'$i'hidedb' or $cfg'Servers'$i'onlydb'. - an issue affecting the create table dialog where the partition selection tool was...

Adobe Flash Selection setFocus Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within Selection's setFocus...

Keybase: Denial of Service through set_preference.json

Hey there, When selecting an image at https://keybase.io//api/1.0/image/setpreference.json, passing an invalid value in identitysrc knocks the server down for 20-30 seconds, with just one request. I have verified this by visiting an external website that checks if a website is down. POC: 1. Conne...

SUSE SLES11 Security Update : sqlite3 (SUSE-SU-2016:2021-1)

This update for sqlite3 fixes the following issues: The following security issue was fixed : - CVE-2016-6153: Fixed a tempdir selection vulnerability bsc987394 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

[SECURITY] Fedora 23 Update: fontconfig-2.11.94-5.fc23

Fontconfig is designed to locate fonts within the system and select them according to requirements specified by applications...

SUSE-SU-2016:2021-1 Security update for sqlite3

This update for sqlite3 fixes the following issues: The following security issue was fixed: - CVE-2016-6153: Fixed a tempdir selection vulnerability bsc987394...

[SECURITY] Fedora 24 Update: fontconfig-2.11.94-7.fc24

Fontconfig is designed to locate fonts within the system and select them according to requirements specified by applications...

Fancier ERP /flight/Print_url_sel. aspx id parameter injection vulnerability

No description provided by source...

The vulnerability of Google Chrome browser allows a malicious actor to trigger a service failure.

The Google Chrome browser contains a vulnerability related to the use of memory after its release use-after-free error in the FrameSelection::updateAppearance function in core/editing/FrameSelection.cpp in Blink. Exploiting this vulnerability allows malicious actors to cause service failures or...

SQLite3 -- Tempdir Selection Vulnerability

KoreLogic security reports: Affected versions of SQLite reject potential tempdir locations if they are not readable, falling back to '.'. Thus, SQLite will favor e.g. using cwd for tempfiles on such a system, even if cwd is an unsafe location. Notably, SQLite also checks the permissions of '.', b...

CVE-2016-0289

shiprec.xml in the SHIPREC application in IBM Maximo Asset Management 7.1 and 7.5 before 7.5.0.10 and 7.6 before 7.6.0.4 allows remote authenticated users to bypass intended item-selection restrictions via unspecified vectors...

CVE-2016-0289

shiprec.xml in the SHIPREC application in IBM Maximo Asset Management 7.1 and 7.5 before 7.5.0.10 and 7.6 before 7.6.0.4 allows remote authenticated users to bypass intended item-selection restrictions via unspecified vectors...

Code injection

shiprec.xml in the SHIPREC application in IBM Maximo Asset Management 7.1 and 7.5 before 7.5.0.10 and 7.6 before 7.6.0.4 allows remote authenticated users to bypass intended item-selection restrictions via unspecified vectors...

CVE-2016-0289

CVE-2016-0289 affects IBM Maximo Asset Management SHIPREC (shiprec.xml) in core 7.6 and 7.5. It allows an authenticated user to bypass item-selection restrictions via the SHIPREC application. Affected versions: Maximo Asset Management 7.6 and 7.5 (and related Industry Solutions/SmartCloud Control...

CVE-2016-0289

shiprec.xml in the SHIPREC application in IBM Maximo Asset Management 7.1 and 7.5 before 7.5.0.10 and 7.6 before 7.6.0.4 allows remote authenticated users to bypass intended item-selection restrictions via unspecified vectors...

CVE-2016-0289: Improper Access Control

shiprec.xml in the SHIPREC application in IBM Maximo Asset Management 7.1 and 7.5 before 7.5.0.10 and 7.6 before 7.6.0.4 allows remote authenticated users to bypass intended item-selection restrictions via unspecified vectors...

Forgeable Public/Private Tokens

Overview Affected versions of the jwt-simple package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT, the en...

The vulnerability of the Moodle learning management system allows a hacker to bypass existing access restrictions.

The vulnerability of the Moodle learning management system’s module selection involves deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing access restrictions by visiting a specific URL to add or delete answers in a closed state...

openSUSE Security Update : MozillaThunderbird (openSUSE-2016-222)

This update Mozilla Thunderbird 38.6.0 fixes the following issuesboo963520 : - CVE-2016-1930: Miscellaneous memory safety hazards boo963632 - CVE-2016-1935: Buffer overflow in WebGL after out of memory allocation boo963635 The following upstream fixes are included : - Filters ran on a different...

Network Time Protocol Origin Timestamp Check Impersonation Vulnerability

CERT VU357792 Summary To distinguish legitimate peer responses from forgeries, a client attempts to verify a response packet by ensuring that the origin timestamp in an incoming packet matches the transmit timestamp it transmitted in its last request. A logic error exists that allows packets with...