Debian DSA-4302-1 : openafs - security update

Several vulnerabilities were discovered in openafs, an implementation of the distributed filesystem AFS. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2018-16947 Jeffrey Altman reported that the backup tape controller butc process does accept incoming...

UBUNTU-CVE-2018-16948

An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSC...

Security update for the Linux Kernel (important)

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-10853: A flaw was found in KVM in which certain instructions such as sgdt/sidt call segmentedwritestd doesn't propagate access correctly. As such, during userspac...

CVE-2017-7482

In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and...

afs.enea.it XSS vulnerability

Vulnerable URL: http://www.afs.enea.it/demichel/research.php?authorName=Luisa=%22%3E%3Cscript%3E%20alert%27XSSPOSED%27%20%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 25.11.2017 Latest check for patch:| 25.11.2017 20:52 GMT Vulnerability type:| XSS Vulnerability status:|...

DEBIAN-CVE-2016-9772

OpenAFS 1.6.19 and earlier allows remote attackers to obtain sensitive directory information via vectors involving the 1 client cache partition, 2 fileserver vice partition, or 3 certain RPC responses...

Debian Security Advisory DSA 3775-1 (tcpdump - security update)

Multiple vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service or the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb3775.nasl 6607 2017-07-07 12:04:25Z cfischer $ Auto-generated from...

UBUNTU-CVE-2015-8312

Off-by-one error in afspioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service memory overwrite and system crash via a pioctl with an input buffer size of 4096 bytes...

CVE-2015-8312

Off-by-one error in afspioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service memory overwrite and system crash via a pioctl with an input buffer size of 4096 bytes...

Debian Security Advisory DSA 3387-1 (openafs - security update)

John Stumpo discovered that OpenAFS, a distributed file system, does not fully initialize certain network packets before transmitting them. This can lead to a disclosure of the plaintext of previously processed packets. OpenVAS Vulnerability Test $Id: deb3387.nasl 6608 2017-07-07 12:05:05Z cfisch...

Debian DSA-3569-1 : openafs - security update

Two vulnerabilities were discovered in openafs, an implementation of the distributed filesystem AFS. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2015-8312 Potential denial of service caused by a bug in the pioctl logic allowing a local user to overru...

DEBIAN-CVE-2015-7762

rx/rx.c in OpenAFS before 1.6.15 and 1.7.x before 1.7.33 does not properly initialize the padding of a data structure when constructing an Rx acknowledgement ACK packet, which allows remote attackers to obtain sensitive information by 1 conducting a replay attack or 2 sniffing the network...

CVE-2007-0454

Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system, which is not properly handled during Windows ACL mapping...

DEBIAN-CVE-2015-6587

The vlserver in OpenAFS before 1.6.13 allows remote authenticated users to cause a denial of service out-of-bounds read and crash via a crafted regular expression in a VLListAttributesN2 RPC...

UBUNTU-CVE-2015-3283

OpenAFS before 1.6.13 allows remote attackers to spoof bos commands via unspecified vectors...

Scientific Linux Security Update : openafs on SL5.x, SL6.x, SL7.x i386/x86_64 (20150730)

All server platforms Fix for CVE-2015-3282: vos leaks stack data onto the wire in the clear when creating vldb entries Workaround for CVE-2015-3283: bos commands can be spoofed, including some which alter server state Disabled searching the VLDB by volume name regular expression to avoid possible...

Debian Security Advisory DSA 3320-1 (openafs - security update)

It was discovered that OpenAFS, the implementation of the distributed filesystem AFS, contained several flaws that could result in information leak, denial-of-service or kernel panic. OpenVAS Vulnerability Test $Id: deb3320.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DS...

The vulnerability of the Gentoo Linux operating system, which allows a malicious intruder to compromise the accessibility of protected information

The vulnerability of the openafs package up to version 1.4.6 of the Gentoo Linux operating system can lead to a violation of the accessibility of protected information. This vulnerability can be exploited remotely...

OpenSSH 2.x/3.x Kerberos 4 TGT/AFS Token Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4560/info A buffer overflow condition exists in the OpenSSH server. The condition is exploitable by attackers with valid user credentials in versions 2.9.9 and higher. Exploitation does not require valid user credentials ...

tcpdump 3.4/3.5 AFS ACL Packet Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1870/info tcpdump is a popular network monitoring tool used for watching network traffic written by the Lawrence Berkeley Laboratory. It must at least begin execution as root since it opens and reads from the link layer...