OPENSUSE-SU-2017:0737-1 Security update for irssi

This update to irssi 1.0.2 fixes security issues and bugs. The following vulnerabilities were fixed: boo1029020: Use after free while producing list of netjoins The following non-security changes are included: - Fix in command arg parser to detect missing arguments in tail place - Fix regression...

DEBIAN-CVE-2016-10189

BitlBee before 3.5 allows remote attackers to cause a denial of service NULL pointer dereference and crash and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list...

UBUNTU-CVE-2017-5668

bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service NULL pointer dereference and crash and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list. NOTE: this vulnerability exists because of an incomplete fix for...

Memory Corruption Vulnerability in Auxiliary Communication

HelpEIM WinEIM is an enterprise instant messaging software. A memory corruption vulnerability exists in the handling of folder transfers within the WinEIM software client, which allows an attacker to cause a remote program to crash by constructing a malformed folder that, if successfully exploite...

CVE-2016-6171

Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service memory exhaustion and slave server crash via a large zone transfer for 1 DDNS, 2 AXFR, or 3 IXFR...

UBUNTU-CVE-2016-6171

Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service memory exhaustion and slave server crash via a large zone transfer for 1 DDNS, 2 AXFR, or 3 IXFR...

CVE-2017-5549

It was found that current implementation of kl5kusb105 driver failed to detect short transfers when attempting to read the line state and logged the content of the uninitialized heap transfer buffer...

PXE client computers freeze during multithread network transfers in Windows Server 2012 R2

PXE client computers freeze during multithread network transfers in Windows Server 2012 R2 Symptoms When you deploy Windows Server 2012 R2 through Windows Deployment Services WDS Pre-Boot Execution Environment PXE, the server CPU usage spikes to 100%. In this situation, client computers may freez...

Weak Password Vulnerability in Some Interfaces of China Mobile's Mobile Client

China Mobile Mobile Client is a mobile application launched by China Mobile. A weak password vulnerability exists in some interfaces of the China Mobile mobile client. Since the post data is obtained by reversing the apk using "Eastern=! @$%^&=World" as the password, using 3 des encryption, no...

openSUSE: Security Advisory for openssl (openSUSE-SU-2016:2407-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for openssl (important)

This update for openssl fixes the following issues: OpenSSL Security Advisory 22 Sep 2016 bsc999665 Severity: High OCSP Status Request extension unbounded memory growth CVE-2016-6304 bsc999666 Severity: Low Pointer arithmetic undefined behaviour CVE-2016-2177 bsc982575 Constant time flag not...

SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2016:2394-1)

This update for openssl fixes the following issues: OpenSSL Security Advisory 22 Sep 2016 bsc999665 Severity: High - OCSP Status Request extension unbounded memory growth CVE-2016-6304 bsc999666 Severity: Low - Pointer arithmetic undefined behaviour CVE-2016-2177 bsc982575 - Constant time flag no...

Security update for openssl (important)

This update for openssl fixes the following issues: OpenSSL Security Advisory 22 Sep 2016 boo999665 Severity: High OCSP Status Request extension unbounded memory growth CVE-2016-6304 boo999666 Severity: Low Pointer arithmetic undefined behaviour CVE-2016-2177 boo982575 Constant time flag not...

SUSE SLES12 Security Update : openssl (SUSE-SU-2016:2387-1)

This update for openssl fixes the following issues: OpenSSL Security Advisory 22 Sep 2016 bsc999665 Severity: High - OCSP Status Request extension unbounded memory growth CVE-2016-6304 bsc999666 Severity: Low - Pointer arithmetic undefined behaviour CVE-2016-2177 bsc982575 - Constant time flag no...

DEBIAN-CVE-2016-6172

PowerDNS aka pdns Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service memory exhaustion and secondary DNS server crash via a large 1 AXFR or 2 IXFR response...

WeChat has an arbitrary code execution vulnerability (badkernel)

WeChat is a free application from Tencent that provides instant messaging services for smart terminals. WeChat suffers from a remote arbitrary code execution vulnerability badkernel. Attackers using the vulnerability can carry out quasi-worm spread, and can be sent through the circle of friends a...

FreeBSD : BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers (7d08e608-5e95-11e6-b334-002590263bf5)

ISC reports : DNS protocols were designed with the assumption that a certain amount of trust could be presumed between the operators of primary and secondary servers for a given zone. However, in current practice some organizations have scenarios which require them to accept zone data from source...

Researchers Go Inside a Business Email Compromise Scam

LAS VEGAS – Poor operational security on the part of Nigerian scammers running a Business Email Compromise BEC scheme has given researchers a window into their operations. Dell SecureWorks today published a report at Black Hat USA 2016 on what the criminals involved call wire-wire, or “waya-waya....

CVE-2016-6170

It was found that bind does not implement reasonable restrictions for zone sizes. This allows an explicitly configured primary DNS server for a zone to crash a secondary DNS server, affecting service of other zones hosted on the same secondary server. Mitigation This issue can be mitigated by...

Fierce - A DNS Reconnaissance Tool for Locating Non-Contiguous IP Space

First, credit where credit is due, fierce was originally written by RSnake along with others at http://ha.ckers.org/ . This is simply a conversion to Python 3 to simplify and modernize the codebase. The original description was very apt, so I'll include it here: Fierce is a semi-lightweight scann...