Mandriva Linux Security Advisory : ntp (MDVSA-2015:140)

Updated ntp packages fix security vulnerabilities : If no authentication key is defined in the ntp.conf file, a cryptographically-weak default key is generated CVE-2014-9293. ntp-keygen before 4.2.7p230 uses a non-cryptographic random number generator with a weak seed to generate symmetric keys...

Fedora 20 : dokuwiki-0-0.24.20140929c.fc20 (2015-3211)

This update fixes CVE-2015-2172 - There's a security hole in the ACL plugins remote API component. The plugin failes to check for superuser permissions before executing ACL addition or deletion. This means everybody with permissions to call the XMLRPC API also has permissions to set up their own...

Fedora 21 : dokuwiki-0-0.24.20140929c.fc21 (2015-3186)

This update fixes CVE-2015-2172 - There's a security hole in the ACL plugins remote API component. The plugin failes to check for superuser permissions before executing ACL addition or deletion. This means everybody with permissions to call the XMLRPC API also has permissions to set up their own...

Fedora 22 : dokuwiki-0-0.24.20140929c.fc22 (2015-3079)

This update fixes CVE-2015-2172 - There's a security hole in the ACL plugins remote API component. The plugin failes to check for superuser permissions before executing ACL addition or deletion. This means everybody with permissions to call the XMLRPC API also has permissions to set up their own...

Scientific Linux Security Update : libvirt on SL7.x x86_64 (20150305)

It was found that QEMU's qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions did not correctly perform a domain unlock on a failed ACL check. A remote attacker able to establish a connection to libvirtd could use this flaw to lock a domain of a more privileged user, causing a denial o...

Medium: ntp

Issue Overview: It was reported http://bugs.ntp.org/showbug.cgi?id=2671 that ntp misses validation of vallen value, leading to various information leaks. See for more details. CVE-2014-9297 It was reported http://bugs.ntp.org/showbug.cgi?id=2672 that ntp allows bypassing source IP ACLs on some OS...

SS-2016-012: Missing ACL on reports

More info at https://www.silverstripe.org/download/security-releases/ss-2016-012/...

Updated dokuwiki packages fix CVE-2015-2172

Updated dokuwiki package fixes security vulnerability: DokuWiki before 20140929c has a security issue in the ACL plugins remote API component. The plugin failed to check for superuser permissions before executing ACL addition or deletion. This means everybody with permissions to call the XMLRPC A...

PT-2015-5644

Name of the Vulnerable Software and Affected Versions DokuWiki versions before 2014-05-05d and before 2014-09-29c Description The issue allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the "XMLRPC API". Recommendations For versions before 2014-05-0...

SolarWinds Orion Service - SQL Injection

SolarWinds Orion Service - SQL Injection I found a couple SQL injection vulnerabilities in the core Orion service used in most of the Solarwinds products SAM, IPAM, NPM, NCM, etc…. This service provides a consistent configuration and authentication layer across the products. To be exact, the...

Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream -longterm 3.14.32 and fixes the following security issues: The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a...

MGASA-2015-0070 Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream -longterm 3.14.32 and fixes the following security issues: The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by...

Fedora 21 : libvirt-1.2.9.2-1.fc21 (2015-1892)

Rebased to version 1.2.9.2 - CVE-2014-8131: deadlock and segfault in qemuConnectGetAllDomainStats bz 1172571 - CVE-2015-0236: missing ACL check for the VIRDOMAINXMLSECURE flag in save images and snapshots objects bz 1185769 - CVE-2014-8136: local denial of service in qemu/qemudriver.c bz 1176179...

Amazon Linux AMI : kernel (ALAS-2015-476)

The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the...

CVE-2015-0610

Race condition in the object-group ACL feature in Cisco IOS 15.52T and earlier allows remote attackers to bypass intended access restrictions via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding CEF switching, aka Bug ID...

CVE-2015-0610: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the object-group ACL feature in Cisco IOS 15.52T and earlier allows remote attackers to bypass intended access restrictions via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding CEF switching, aka Bug ID...

MGASA-2015-0063 Updated ntp packages fix security vulnerabilities

Updated ntp packages fix security vulnerabilities: Stephen Roettger of the Google Security Team, Sebastian Krahmer of the SUSE Security Team and Harlan Stenn of Network Time Foundation discovered that the length value in extension fields is not properly validated in several code paths in...

PT-2015-4754

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.52T and earlier Description A race condition in the object-group ACL feature allows remote attackers to bypass intended access restrictions via crafted network traffic that triggers improper handling of the timing of...

DLA-149-1 ntp - security update

Bulletin has no description...

Debian DSA-3154-1 : ntp - security update

Several vulnerabilities were discovered in the ntp package, an implementation of the Network Time Protocol. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2014-9750 Stephen Roettger of the Google Security Team, Sebastian Krahmer of the SUSE Security Tea...