Debian DSA-3039-1 : chromium-browser - security update

Several vulnerabilities were discovered in the chromium web browser. - CVE-2014-3160 Christian Schneider discovered a same origin bypass issue in SVG file resource fetching. - CVE-2014-3162 The Google Chrome development team addressed multiple issues with potential security impact for chromium...

DEBIAN-CVE-2012-6657

The socksetsockopt function in net/core/sock.c in the Linux kernel before 3.5.7 does not ensure that a keepalive action is associated with a stream socket, which allows local users to cause a denial of service system crash by leveraging the ability to create a raw socket...

CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix

It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

kernel: net: rds: dereference of a NULL device in rds_iw_laddr_check()

A NULL pointer dereference flaw was found in the rdsiwladdrcheck function in the Linux kernel's implementation of Reliable Datagram Sockets RDS. A local, unprivileged user could use this flaw to crash the system...

kernel: net: rds: dereference of a NULL device in rds_ib_laddr_check()

A NULL pointer dereference flaw was found in the rdsibladdrcheck function in the Linux kernel's implementation of Reliable Datagram Sockets RDS. A local, unprivileged user could use this flaw to crash the system...

Unbreakable Enterprise kernel security and bug fix update

kernel-uek 3.8.13-44 - net: Use netlinknscapable to verify the permisions of netlink messages Eric W. Biederman Orabug: 19404229 CVE-2014-0181 - net: Add variants of capable for use on netlink messages Eric W. Biederman Orabug: 19404229 - net: Add variants of capable for use on on sockets Eric W...

Authentication Bypass

Overview Affected versions of this package are vulnerable to Authentication Bypass. The 1 serfsslcertissuer, 2 serfsslcertsubject, and 3 serfsslcertcertificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name CN...

Google Chrome Multiple Vulnerabilities - 01 (Aug 2014) - Windows

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Google Pushes Chrome 36, Fixes 12 Issues

Google patched its Chrome browser this week, fixing 12 vulnerabilities, including both a serious information disclosure bug and a use-after-free vulnerability that could let users obtain potentially sensitive information and execute arbitrary code. French security researcher Antoine Delignat-Lava...

CentOS 6 / 7 : openssl (CESA-2014:1052)

Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

FreeBSD : chromium -- multiple vulnerabilities (df7754c0-2294-11e4-b505-000c6e25e3e9)

Google Chrome Releases reports : 12 security fixes in this release, including - 390174 High CVE-2014-3165: Use-after-free in web sockets. Credit to Collin Payne. - 398925 High CVE-2014-3166: Information disclosure in SPDY. Credit to Antoine Delignat-Lavaud. - 400950 CVE-2014-3167: Various fixes...

CVE-2014-3165

Use-after-free vulnerability in modules/websockets/WorkerThreadableWebSocketChannel.cpp in the Web Sockets implementation in Blink, as used in Google Chrome before 36.0.1985.143, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigge...

Design/Logic Flaw

Use-after-free vulnerability in modules/websockets/WorkerThreadableWebSocketChannel.cpp in the Web Sockets implementation in Blink, as used in Google Chrome before 36.0.1985.143, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigge...

CVE-2014-3165

The CVE-2014-3165 issue affects the Blink WebSockets implementation (WorkerThreadableWebSocketChannel.cpp) in Google Chrome/Chromium prior to 36.0.1985.143 and is a use-after-free vulnerability. It could allow a remote attacker to cause a denial of service or other impact via long object lifetime...

CVE-2014-3165

Removed by vendor...

CVE-2014-3165

Use-after-free vulnerability in modules/websockets/WorkerThreadableWebSocketChannel.cpp in the Web Sockets implementation in Blink, as used in Google Chrome before 36.0.1985.143, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigge...

Google Chrome < 36.0.1985.143 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is a version prior to 36.0.1985.143. It is, therefore, affected by the following vulnerabilities : - A use-after-free error exists in the Web Sockets implementation in Blink which allows remote attackers to cause a denial of service...

MGASA-2014-0327 Updated kdelibs4 packages fix security vulnerability and various bugs

This update fixes a security vulnerability in the polkit authentication backend of kdelibs CVE-2014-5033 mga13792, and fixes some additional issues: - duplicate targets in PythonMacros.cmake reviewboard kde 111371, - kded4 leak sockets in NetworkInterface::isWireless bko324954, - media type...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 12 security fixes in this release, including 390174 High CVE-2014-3165: Use-after-free in web sockets. Credit to Collin Payne. 398925 High CVE-2014-3166: Information disclosure in SPDY. Credit to Antoine Delignat-Lavaud. 400950 CVE-2014-3167: Various fixes from...

Stable Channel Update

The Stable Channel has been updated to 36.0.1985.143 for Windows, Mac and Linux. This release contains a Flash Player update. Security Fixes and Rewards This update includes 12 security fixes. Below, we highlight fixes that were either contributed by external researchers or particularly...