MGASA-2013-0175 Updated subversion packages fix security vulnerabilities

Subversion repositories with the FSFS repository data store format can be corrupted by newline characters in filenames. A remote attacker with a malicious client could use this flaw to disrupt the service for other users using that repository CVE-2013-1968. Subversion's svnserve server process ma...

Wonderware Intelligence Tableau Server Ruby on Rails Improper Input Validation (Update A)

Overview This updated advisory was orignally posted to the US-CERT secure Portal library on February 5, 2013, and is now being released to the ICS-CERT Web page. Mitigation details for multiple vulnerabilities that impact third-party software integrated into the Invensys Wonderware Intelligence...

Service Disruption or Destruction: Which is Worse?

Outcomes in security tend to be about data loss; stolen pharmaceutical formulas, jet fighter blueprints, patient records, credit card numbers etc. All of these come with a great cost to the victim and make for sexy headlines. But far too little is dissected and analyzed about service disruptions...

Mozilla: Heap memory corruption issues found using Address Sanitizer (MFSA 2012-86)

Buffer overflow in the nsCharTraits::length function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service heap memory...

Twitter Denies Hacktivists Behind Severe Outage

Twitter officials say it was a “cascading bug” and not the handiwork of hacktivists that brought down the microblogging site today in two separate outages. “This wasn’t due to a hack or our new office or Euro 2012 or GIF avatars, as some have speculated today,” Mazen Rawashdeh, the company’s vice...

MySQL < 5.0.23 / 5.1.12 Denial of Service

The version of MySQL installed on the remote host is older than 5.0.23 or 5.1.12. As such, it reportedly is affected by an off-by-one buffer overflow. A local attacker could use this flaw to crash the service. Note that this vulnerability is disputed as the attacker needs extensive permissions to...

Hotmail, MSN, Office 365, live.com sites down (now up)

Hotmail , MSN , Office 365 , live.com sites down now up A number of Microsoft online services, including Hotmail, MSN, Office 365, and seemingly most if not all of .live.com addresses are currently "experiencing an outage". MSN and Office 365 have already tweeted about it: The downtime, which...

vBulletin 4.1.3pl3 / 4.1.4pl3 / 4.1.5pl1 Cross Site Scripting

Advisory Information Title: vBulletin Cross Site Scripting Vulnerability Date published: 02-08-2011 Vendors contacted: vBulletin team Vulnerability Information Class: XSS flaw Vulnerable page: Admin Login Page admincp Remotely Exploitable: Yes Locally Exploitable: No Vulnerability Description...

Trust the ‘Cloud’ (just make sure you have it examined first)

In the wake of Amazons Web Service disruption over the past few days we think it is important to look at the case a little closer...

Amazon Web Service Down, No Timeline for Remedy

Amazon Web Service’s AWS Elastic Compute Cloud EC2, based in Northern Virginia, went offline early this morning, taking with it a number of popular sites including, news aggregator Reddit and question and answer site and TechCrunch darling, Quora.The Web hosting firm’s Relational Database Service...

DEBIAN-CVE-2010-1623

Memory leak in the aprbrigadesplitline function in buckets/aprbrigade.c in the Apache Portable Runtime Utility library aka APR-util before 1.3.10, as used in the modreqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service memory...

Denial of Service (DoS) Vulnerability in Cosminexus

Overview Cosminexus series products contain a vulnerability that could cause a denial of service DoS condition when receiving unexpected data. After it abends, the service can be restarted by rebooting the system. Impact A remote attacker could cause a denial of service DoS condition. Solution...

MP3 Cutter 1.8 MP3 - File Processing Remote Denial of Service

MP3 Cutter 1.8 MP3 - File Processing Remote Denial of Service source: https://www.securityfocus.com/bid/41506/info MP3 Cutter is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause an affected application to crash, denying service to legitimate users. MP...

kernel: e1000_clean_rx_irq() denial of service

Integer underflow in the e1000cleanrxirq function in drivers/net/e1000/e1000main.c in the e1000 driver in the Linux kernel before 2.6.30-rc8, the e1000e driver in the Linux kernel, and Intel Wired Ethernet aka e1000 before 7.5.5 allows remote attackers to cause a denial of service panic via a...

DEBIAN-CVE-2008-3547

Buffer overflow in the server in OpenTTD 0.6.1 and earlier allows remote authenticated users to cause a denial of service persistent game disruption or possibly execute arbitrary code via vectors involving many long names for "companies and clients."...

Adobe AIR < 1.5 JavaScript Code Execution Vulnerability

Adobe AIR is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[AJECT] SurgeMail IMAP 3.9e vulnerability

---------------------------------------- Synopsis ---------------------------------------- SurgeMail Mail Server 3.9e Windows and Unix-based versions is vulnerable to denial-of-service DoS attacks. The nature of the crash may indicate a buffer overflow problem, but the developers claimed otherwis...

[AJECT] Softalk IMAP Server 8.5.1 DoS vulnerability

---------------------------------------- Synopsis ---------------------------------------- Softalk IMAP Server 8.5.1 is vulnerable to denial-of-service DoS attacks. The IMAP server crashes when processing an APPEND command with a strange parameter see details bellow. Other commands may also trigg...

CORE-2008-0813 - vBulletin Cross Site Scripting Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ vBulletin Cross Site Scripting Vulnerability Advisory Information Title: vBulletin Cross Site Scripting Vulnerability Advisory ID: CORE-2008-0813 Advisory URL:...

vBulletin Cross Site Scripting Vulnerability

1. Advisory Information Title: vBulletin Cross Site Scripting Vulnerability Advisory ID: CORE-2008-0813 Advisory URL:https://www.coresecurity.com/core-labs/advisories/vbulletin-cross-site-scripting-vulnerability Date published: 2008-08-20 Date of last update: 2008-08-20 Vendors contacted:...