PolicyKit Elevation of Privilege Vulnerability

PolicyKit a.k.a. Polkit is a tool from Red Hat, Inc. for controlling application privileges on Unix-compatible systems. An elevation of privilege vulnerability exists in versions of PolicyKit prior to 0.113. It allows a local user to gain privileges by repeatedly manipulating Id...

mod_jk: information leak due to incorrect JkMount/JkUnmount directives processing

It was discovered that a JkUnmount rule for a subtree of a previous JkMount rule could be ignored. This could allow a remote attacker to potentially access a private artifact in a tree that would otherwise not be accessible to them...

mysql: unspecified vulnerability related to Server:Optimizer (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier and 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer...

Lynis 2.1.1 - Security Auditing Tool for Unix/Linux Systems

Lynis is an open source security auditing tool. Commonly used by system administrators, security professionals and auditors, to evaluate the security defenses of their Linux/Unix based systems. It runs on the host itself, so it can perform very extensive security scans. Supported operating system...

php: integer overflow leading to heap overflow when reading FTP file listing

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code...

node, iojs, and v8 -- denial of service

node reports: This release of Node.js fixes a bug that triggers an out-of-band write in V8's utf-8 decoder. This bug impacts all Buffer to String conversions. This is an important security update as this bug can be used to cause a denial of service attack...

php: buffer over-read in Phar metadata parsing

A buffer over-read flaw was found in PHP's phar PHP Archive paths implementation. A malicious script author could possibly use this flaw to disclose certain portions of server memory...

OSSEC 2.7 2.8.1 - diff Local Privilege Escalation

OSSEC 2.7 2.8.1 - diff Local Privilege Escalation Fix for CVE-2015-3222 which allows for root escalation via syscheck - https://github.com/ossec/ossec-hids/releases/tag/2.8.2 Affected versions: 2.7 - 2.8.1 Beginning is OSSEC 2.7 d88cf1c9 a feature was added to syscheck, which is the daemon that...

IT-Grundschutz M4.026: Regelmäßiger Sicherheitscheck des Unix-Systems

IT-Grundschutz M4.026: Regelmäßiger Sicherheitscheck des Unix-Systems. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM4026.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 4.026 Authors: Thomas Rotter Copyright: Copyright c 2015 Greenbone Networ...

IT-Grundschutz M4.026: Regelmaessiger Sicherheitscheck des Unix-Systems

IT-Grundschutz M4.026: Regelmaessiger Sicherheitscheck des Unix-Systems. Stand: 14. Ergaenzungslieferung 14. EL. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

pcre: incorrect handling of zero-repeat assertion conditions

A flaw was found in the way PCRE handled certain malformed regular expressions. This issue could cause an application for example, Konqueror linked against PCRE to crash while parsing malicious regular expressions...

Debian Security Advisory DSA 3171-1 (samba - security update)

Richard van Eeden of Microsoft Vulnerability Research discovered that Samba, a SMB/CIFS file, print, and login server for Unix, contains a flaw in the netlogon server code which allows remote code execution with root privileges from an unauthenticated connection. OpenVAS Vulnerability Test $Id:...

Ghosts, goblins Grinch: Bash broken shell shellshock a more serious Linux vulnerability-vulnerability warning-the black bar safety net

Security researcher at the Linux operating system found in a group called the ghosts, goblins（Grinch's vulnerability, the vulnerability exists in the linux system, and Bash broken shell shellshock）vulnerabilities in victim machines to get the highest permissions. Ghosts, goblins overview Bash...

bind: delegation handling denial of service

A denial of service flaw was found in the way BIND followed DNS delegations. A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash...

JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment...

Bash Environment Variable Handling Shell Command Injection Via CUPS

Added: 11/05/2014 CVE: CVE-2014-6271 BID: 70103 OSVDB: 112004 Background GNU Bash Bourne Again SHell is a command shell commonly used on Linux and Unix systems. CUPS is printing software for UNIX-like systems that allows a computer to act as a print server. Problem The Bash shell executes command...

Shellshock Exploits Spreading Mayhem Botnet Malware

The Mayhem malware piqued researchers’ interest earlier this summer after a published report from researchers at Russian search engine Yandex shed light on its ability to target Linux and UNIX machines and run under restricted privileges. Generally, web servers are well guarded against remote...

Apple Patches Shellshock Vulnerability in Bash

Apple tonight released its patch for the Bash vulnerability, updating OS X Lion, Mountain Lion and Mavericks. Late Friday, Apple reassured Mac OS X users that most were protected by default, but nonetheless that it was working on a patch. The vulnerability in Bash, which stands for Bourne Again...

M/Monit 3.3.2 - CSRF Vulnerability

No description provided by source. Vulnerability title: M/Monit CSRF Author: Dolev Farhi Contact: dolevf at openflare dot com @dolevff Application: M/Monit 3.2.2 Date: 13.9.2014 Relevant CVEs: N/A Vulnerable version: = 3.2.2 Fixed version: N/A 1. About the application ------------------------ Eas...

Hackers Using 'Shellshock' Bash Vulnerability to Launch Botnet Attacks

Researchers on Thursday discovered a critical remotely exploitable vulnerability in the widely used command-line shell GNU Bourne Again Shell Bash, dubbed "Shellshock" which affects most of the Linux distributions and servers worldwide, and may already have been exploited in the wild to take over...