openSUSE Security Update : libqt4 (openSUSE-SU-2014:0070-1)

Fixes XML Entity Expansion Denial of Service bnc856832, CVE-2013-4549 - add backported patch libqt4-disallow-deep-or-widely-nested-entity-references. patch - add backported patch libqt4-fully-expand-all-entities.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

openSUSE Security Update : libqt4 (openSUSE-SU-2014:0125-1)

Fixes XML Entity Expansion Denial of Service bnc856832, CVE-2013-4549 - add backported patch libqt4-disallow-deep-or-widely-nested-entity-references. patch - add backported patch libqt4-fully-expand-all-entities.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

CentOS Update for libvirt CESA-2014:0560 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-2194

system/egain/chat/entrypoint in Cisco Unified Web and E-mail Interaction Manager 9.02 allows remote attackers to have an unspecified impact by injecting a spoofed XML external entity...

GLSA-201405-14 : Ruby OpenID: Denial of Service

The remote host is affected by the vulnerability described in GLSA-201405-14 Ruby OpenID: Denial of Service An XML entity parsing error has been discovered in Ruby OpenID. Impact : A remote attacker could send a specially crafted XML file, possibly resulting in a Denial of Service condition...

Nixu NameSurfer多个安全漏洞

CVE ID:CVE-2014-0060、CVE-2014-0061、CVE-2014-0062、CVE-2014-0063、CVE-2014-0064、CVE-2014-0065、CVE-2014-0066 Nixu NameSurfer是一个实现集中地址管理覆盖的IPAM软件应用解决方案。 Nixu NameSurfer存在多个安全漏洞： 1，部分输入在使用之前缺少过滤，允许攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 2，解析XML实体时存在错误，允许攻击者利用特制的包含外部实体引用的XML文档来获取本地资源数据或消耗服务器资源。...

MGASA-2014-0151 Updated php-ZendFramework packages fix multiple vulnerabilities

Updated php-ZendFramework packages fix security vulnerabilities: XML eXternal Entity XXE and XML Entity Expansion XEE flaws were discovered in the Zend Framework. An attacker could use these flaws to cause a denial of service, access files accessible to the server process, or possibly perform oth...

Zend Framework XML外部实体和安全绕过漏洞

Bugtraq ID:66358 Zend Framework是一款开放源代码的PHP5开发框架实现。 Zend Framework存在多个安全漏洞： 1，处理XML实体时存在错误，允许攻击者通过特制的包含外部实体引用的XML文档来获取本地文件内容或消耗服务器资源。 2，ZendOpenId和ZendOpenId consumer的登录机制存在错误，允许攻击者利用漏洞无需任意验证凭据伪造其他用户/身份。 0 Zend Framework 1.x Zend Framework 1.12.4已经修复该漏洞，建议用户下载更新： http://framework.zend.com...

QtCore: Denial of service

Background The Qt toolkit is a comprehensive C++ application development framework. Description A vulnerability in QXmlSimpleReader’s XML entity parsing has been discovered. Impact A remote attacker could entice a user to open a specially crafted XML file using an application linked against QtCor...

Updated qt5 packages fix security vulnerability.

It was discovered that QXmlSimpleReader in Qt incorrectly handled XML entity expansion. An attacker could use this flaw to cause Qt applications to consume large amounts of resources, resulting in a denial of service CVE-2013-4549...

MGASA-2014-0115 Updated qt5 packages fix security vulnerability.

It was discovered that QXmlSimpleReader in Qt incorrectly handled XML entity expansion. An attacker could use this flaw to cause Qt applications to consume large amounts of resources, resulting in a denial of service CVE-2013-4549...

McAfee ePolicy Orchestrator < 4.6.7 HF940148 XML Entity Injection (SB10065)

The remote Windows host is running a version of McAfee ePolicy Orchestrator ePO prior to 4.6.7 hotfix 940148. It is, therefore, affected by an XML entity injection vulnerability due to a failure to properly sanitize user-supplied input. An authenticated, remote attacker with permission to add new...

Symantec Endpoint Protection Manager XXE and SQL Injection Vulnerabilities

Added: 02/24/2014 CVE: CVE-2013-5014 BID: 65466 OSVDB: 103306 Background Symantec Endpoint Protection, by Symantec Corporation, is an antivirus and personal firewall product designed to be centrally managed in corporate environments by the Symantec Endpoint Protection Manager SEPM. The SEPM...

SuSE 11.3 Security Update : libQt (SAT Patch Number 8907)

The Qt library was updated to fix a XML entity expansion attack XXE. CVE-2013-4549 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc. if NASLLEVEL...

Symantec Endpoint Protection Manager Vulnerabilities

SUMMARY The management console for Symantec Endpoint Protection Manager does not properly handle external XML data, which could potentially allow unauthorized access to restricted server-side data and console management functionality. The management console for Symantec Endpoint Protection Manage...

CentOS Update for java CESA-2014:0097 centos5

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 19 : qt3-3.3.8b-56.fc19 (2013-22883)

This update fixes CVE-2013-4549 XML Entity Expansion Denial of Service in Qt 3. See the Qt Project Security Advisory for details: http://lists.qt-project.org/pipermail/announce/2013-December/000036.ht ml In addition, this update fixes : - QTBUG-35459, a too low character limit for XML entities...

Fedora 20 : qt3-3.3.8b-56.fc20 (2013-22847)

This update fixes CVE-2013-4549 XML Entity Expansion Denial of Service in Qt 3. See the Qt Project Security Advisory for details: http://lists.qt-project.org/pipermail/announce/2013-December/000036.ht ml In addition, this update fixes : - QTBUG-35459, a too low character limit for XML entities...

Fedora 19 : qt-4.8.5-15.fc19 (2013-22932)

Qt Project Security Advisory: XML Entity Expansion Denial of Service CVE-2013-4549 See also http://lists.qt-project.org/pipermail/announce/2013-December/000036.ht ml In addition, this update : - adds support for the aarch64 architecture, - fixes QTBUG-35459, a too low character limit for XML...

Fedora 20 : qt-4.8.5-15.fc20 (2013-22860)

Qt Project Security Advisory: XML Entity Expansion Denial of Service CVE-2013-4549 See also http://lists.qt-project.org/pipermail/announce/2013-December/000036.ht ml In addition, this update : - adds support for the aarch64 architecture, - fixes QTBUG-35459, a too low character limit for XML...