135 matches found
Important: Red Hat Security Advisory: yum-updatesd security update
An updated yum-updatesd package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...
yum: yum-cron installs unsigned packages
It was discovered that yum-updatesd did not properly perform RPM package signature checks. When yum-updatesd was configured to automatically install updates, a remote attacker could use this flaw to install a malicious update on the target system using an unsigned RPM or an RPM signed with an...
RHEL 5 : yum-updatesd (RHSA-2014:1004)
An updated yum-updatesd package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...
openstack-heat-templates: setting gpgcheck=0 for signed packages
OpenStack Heat Templates heat-templates, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors...
CVE-2012-6088
The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package...
Design/Logic Flaw
The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package...
CVE-2012-6088
The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package...
CVE-2012-6088
The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package...
KLA10303 SB vulnerability in RPM
Improper error handling was found in RPM. By exploiting this vulnerability malicious users can bypass signature checks. This vulnerability can be exploited remotely via a specially designed packet. Original advisories - Related products RPM-Remote-Print-Manager CVE list CVE-2012-6088 warning...
CVE-2012-6088
The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package...
Cisco AnyConnect VPN Client Arbitrary Program Instantiation Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco AnyConnect VPN Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists due to...
NTP EVP_VerifyFinal() Security Bypass Vulnerability
This host has NTP installed and is prone to security bypass vulnerability. OpenVAS Vulnerability Test $Id: gbntpsecbypassvuln.nasl 7573 2017-10-26 09:18:50Z cfischer $ NTP EVPVerifyFinal Security Bypass Vulnerability Authors: Chandan S Copyright: Copyright c 2009 Greenbone Networks GmbH,...
Sun Java JRE Multiple Vulnerabilities (244986 et al)
The version of Sun Java Runtime Environment JRE installed on the remote host is earlier than 6 Update 11 / 5.0 Update 17 / 1.4.219 / 1.3.124. Such versions are potentially affected by the following security issues : - The JRE creates temporary files with insufficiently random names. 244986 - Ther...
USN-252-1: gnupg vulnerability
Tavis Ormandy discovered a potential weakness in the signature verification of gnupg. gpgv and gpg --verify returned a successful exit code even if the checked file did not have any signature at all. The recommended way of checking the result is to evaluate the status messages, but some third par...