Important: Red Hat Security Advisory: rpm security update

Updated rpm packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6; Red Hat Enterprise Linux 3 and 4 Extended Life Cycle Support; Red Hat Enterprise Linux 5.3 Long Life; and Red Hat Enterprise Linux 5.6, 6.0 and 6.1 Extended Update Support. The Red Hat...

Input validation

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

extension): MITM due to improper validation of AX attribute signatures

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

GLSA-201110-15 : GnuPG: User-assisted execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-201110-15 GnuPG: User-assisted execution of arbitrary code The GPGSM utility in GnuPG contains a use-after-free vulnerability that may be exploited when importing a crafted X.509 certificate explicitly or during the signature...

CVE-2011-3138

The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit JDK class, which might allow attackers to bypass...

CVE-2011-3138

The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit JDK class, which might allow attackers to bypass...

CVE-2011-3138: Undefined Security Weakness

The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit JDK class, which might allow attackers to bypass...

PT-2011-4268

Name of the Vulnerable Software and Affected Versions IBM Tivoli Federated Identity Manager versions 6.2.0 through 6.2.0.8 IBM Tivoli Federated Identity Manager Business Gateway versions 6.2.0 through 6.2.0.8 Description The issue is related to the LTPA STS module support implementation, which...

Java HotSpot Cryptographic Provider signature verification vulnerability

An attacker can add a cryptographic provider containing cipher implementation signed by an untrusted certificate. The attacker can also create his or her own jurisdiction policy files signed by an untrusted certificate. In order to achieve this, the attacker must first of all add a fake...

CVE-2011-1637

CVE-2011-1637 affects Cisco Unified IP Phones 7900 Series (TNP phones). The issue is an insecure signature verification check that allows an authenticated, local attacker to load a software image without verification, due to improper verification of signatures. Root cause: unsigned code installat...

PT-2011-3258

Name of the Vulnerable Software and Affected Versions Cisco Unified IP Phones 7900 devices aka TNP phones versions prior to 9.2.1 Description The issue is related to improper verification of signatures for software images, allowing local users to gain privileges via a crafted image. Recommendatio...

CVE-2011-1637: Undefined Security Weakness

Cisco Unified IP Phones 7900 devices aka TNP phones with software before 9.2.1 do not properly verify signatures for software images, which allows local users to gain privileges via a crafted image, aka Bug ID CSCtn65962...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified IP Phones 7900 Series

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified IP Phones 7900 Series Advisory ID: cisco-sa-20110601-phone Revision 1.0 For Public Release 2011 June 1 1600 UTC GMT +----------------------------------------------------------------...

Cisco Unified IP Phones 7900 Series Unsigned Code Installation Vulnerability

Cisco Unified IP Phones 7900 Series devices contain a vulnerability that could allow an authenticated, local attacker to load a software image without verification. The vulnerability is due to insecure security checks on software images. An authenticated, local attacker could exploit this...

Debian Security Advisory DSA 2219-1 (xmlsec1)

The remote host is missing an update to xmlsec1 announced via advisory DSA 2219-1. OpenVAS Vulnerability Test $Id: deb22191.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2219-1 xmlsec1 Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

xmlsec1: arbitrary file creation when verifying signatures

xslt.c in XML Security Library aka xmlsec before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification...

Debian DSA-2219-1 : xmlsec1 - arbitrary file overwrite

Nicolas Gregoire discovered that the XML Security Library xmlsec allowed remote attackers to create or overwrite arbitrary files through specially crafted XML files using the libxslt output extension and a ds:Transform element during signature verification. %NASLMINLEVEL 70300 C Tenable Network...

DSA-2219-1 xmlsec1 - file overwrite

Bulletin has no description...

Mandriva Update for xmlsec1 MDVSA-2011:063 (xmlsec1)

Check for the Version of xmlsec1 OpenVAS Vulnerability Test Mandriva Update for xmlsec1 MDVSA-2011:063 xmlsec1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Linux Security Advisory : xmlsec1 (MDVSA-2011:063)

A vulnerability was discovered and corrected in xmlsec1 : xslt.c in XML Security Library aka xmlsec before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a...