SUSE SLED10 / SLES10 Security Update : kernel (SUSE-SU-2013:0856-1)

The SUSE Linux Enterprise 10 SP4 kernel has been updated to fix various bugs and security issues. Security issues fixed : CVE-2012-4444: The ip6fragqueue function in net/ipv6/reassembly.c in the Linux kernel allowed remote attackers to bypass intended network restrictions via overlapping IPv6...

PT-2015-4365

Name of the Vulnerable Software and Affected Versions libzmq versions prior to 4.0.6 libzmq versions 4.1.x prior to 4.1.1 Description The issue allows remote attackers to conduct downgrade attacks, bypassing security mechanisms of the ZMTP v3 protocol by using a ZMTP v2 or earlier header...

Epicor Retail Store Help System 3.2.03.01.008 Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Title: Code Injection in Epicor Retail Store Help System CVE: CVE-2015-2210 Vendor: Epicor Product: CRS Retail Store v3.2.03.01.008 Affected version: 3.2.03.01.008 Reported by: Zeng Xianbo Joseph [email protected] Issue identified by: Zeng...

ESA-2015-056: EMC PowerPath Virtual Appliance Undocumented User Accounts Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-056: EMC PowerPath Virtual Appliance Undocumented User Accounts Vulnerability EMC Identifier: ESA-2015-056 CVE Identifier: CVE-2015-0529 Severity Rating: CVSS v2 Base Score: 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N Affected products: • EMC PowerPath...

CentOS 7 : openssl (CESA-2015:0716)

Updated openssl packages that fix several security issues and one bug are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, ar...

Sagem F@st 3304-V2 - Telnet Crash (PoC)

Sagem F@st 3304-V2 - Telnet Crash PoC Title : Sagem F@st 3304-V2 Telnet Crash POC Vendor : http://www.sagemcom.com Severity : High Tested Router : Sagem F@st 3304-V2 3304-V1, other versions may also be affected Date : 2015-03-08 Author : Loudiyi Mohamed Contact : [email protected] Blog :...

Sagem F@st 3304-V2 - Telnet Crash (PoC)

Title : Sagem F@st 3304-V2 Telnet Crash POC Vendor : http://www.sagemcom.com Severity : High Tested Router : Sagem F@st 3304-V2 3304-V1, other versions may also be affected Date : 2015-03-08 Author : Loudiyi Mohamed Contact : [email protected] Blog :...

Sagem F@st 3304-V2 - Local File Inclusion

Title : Sagem F@st 3304-V2 Directory Traversal Vulnerability Vendor : http://www.sagemcom.com Severity : High Tested Router : Sagem F@st 3304-V2 3304, other versions may also be affected Date : 2015-03-01 Author : Loudiyi Mohamed Contact : [email protected] Blog :...

CVE-2014-9684

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them before the uploads...

CVE-2015-1881

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them, a different...

CVE-2014-9684

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them before the uploads...

CVE-2015-1881: Undefined Security Weakness

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them, a different...

CVE-2014-9684: Undefined Security Weakness

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them before the uploads...

PT-2015-5483

Name of the Vulnerable Software and Affected Versions OpenStack Image Registry and Delivery Service Glance versions 2014.2 through 2014.2.2 Description The issue allows remote authenticated users to cause a denial of service, specifically disk consumption, by creating and then deleting a large...

PT-2015-4352

Name of the Vulnerable Software and Affected Versions OpenStack Image Registry and Delivery Service Glance versions 2014.2 through 2014.2.2 Description The issue allows remote authenticated users to cause a denial of service, specifically disk consumption, by creating a large number of images usi...

Important: Red Hat Security Advisory: openstack-glance security update

Updated openstack-glance packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 4.0 and Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security...

PT-2015-4554

Name of the Vulnerable Software and Affected Versions Xen versions 4.5.x Description The issue allows local guest users to cause a denial of service, resulting in a host crash, by writing an invalid value to the GICD.SGIR register. This occurs when the vgic v2 to sgi function in arch/arm/vgic-v2....

xen-kernel -- arm: vgic-v2: GICD_SGIR is not properly emulated

The Xen Project reports: When decoding a guest write to a specific register in the virtual interrupt controller Xen would treat an invalid value as a critical error and crash the host. By writing an invalid value to the GICD.SGIR register a guest can crash the host, resulting in a Denial of Servi...

Design/Logic Flaw

The V2 API in OpenStack Image Registry and Delivery Service Glance before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of a...

CVE-2015-1195

The V2 API in OpenStack Image Registry and Delivery Service Glance before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of a...