java-1.6.0-openjdk security and bug fix update

1:1.6.0.1-5.1.13.3 - updated to icedtea 1.13.3 - updated to openjdk-6-src-b31-15apr2014 - renmoved upstreamed patch7, 1.13fixes.patch - Resolves: rhbz1085009...

Security fix for the ALT Linux 7 package kernel-src-kvm version 3.10.21-alt5

March 4, 2014 Led 3.10.21-alt5 - updates from linux-3.10.33: + kvm: x86: fix emulator buffer overflow CVE-2014-0049...

CVE-2013-3294: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Exponent CMS before 2.2.0 release candidate 1 allow remote attackers to execute arbitrary SQL commands via the 1 src or 2 username parameter to index.php...

PT-2014-2674

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.2.0 release candidate 1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the src or username parameter to the "index.php" endpoint. Recommendations For...

CVE-2014-1485

The Content Security Policy CSP implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient...

CVE-2014-1485: Undefined Security Weakness

The Content Security Policy CSP implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient...

PT-2014-1146

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 27.0 SeaMonkey versions prior to 2.24 Description The Content Security Policy CSP implementation operates on XSLT stylesheets according to style-src directives instead of script-src directives. This might allo...

PT-2014-1161

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 27.0 SeaMonkey versions prior to 2.24 Description The issue is related to errors in the implementation of the MPostWriteBarrier class, allowing remote attackers to cause a denial of service or possibly execute...

CVE-2013-6017: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element...

PT-2014-3012

Name of the Vulnerable Software and Affected Versions Atmail Webmail Server versions prior to 7.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message. This can be demonstrated by the SRC attribute of an IFRAME element, enabling...

Debian Security Advisory DSA 2834-1 (typo3-src - several vulnerabilities)

Several vulnerabilities were discovered in TYPO3, a content management system. This update addresses cross-site scripting, information disclosure, mass assignment, open redirection and insecure unserialize vulnerabilities and corresponds to TYPO3-CORE-SA-2013-004 . OpenVAS Vulnerability Test $Id:...

Debian: Security Advisory (DSA-2834-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-2057-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security fix for the ALT Linux 7 package kernel-src-kvm version 3.10.21-alt1

3.10.21-alt1 built Dec. 20, 2013 Led in task 110736 Dec. 19, 2013 Led - 3.10.21 - updates from linux-3.10.25: + CVE-2013-4587 + CVE-2013-6367 + CVE-2013-6368 + CVE-2013-6376...

Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : qt4-x11, qtbase-opensource-src vulnerability (USN-2057-1)

It was discovered that QXmlSimpleReader in Qt incorrectly handled XML entity expansion. An attacker could use this flaw to cause Qt applications to consume large amounts of resources, resulting in a denial of service. Note that Tenable Network Security has extracted the preceding description bloc...

Oracle Linux 5 / 6 : java-1.6.0-openjdk (ELSA-2013-1505)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1505 advisory. 1:1.6.0.0-1.68.1.11.14 - updated to icedtea6-1.11.14.tar.gz - added and applied 1.11.14-fixes.patch, patch10 to fix build issues - adapted patch8...

Low: python-crypto

Issue Overview: The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator PRNG before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race...

CVE-2011-4106: Improper Input Validation

TimThumb timthumb.php before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache...

PT-2013-1421

Name of the Vulnerable Software and Affected Versions TimThumb timthumb.php versions prior to 2.0 Description The issue allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter. This is done by accessing the uploaded file via a...

Debian DSA-2772-1 : typo3-src - XSS

Markus Pieton and Vytautas Paulikas discovered that the embedded video and audio player in the TYPO3 web content management system is suspectible to cross-site-scripting. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fro...