Ubuntu: Security Advisory (USN-3038-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-3623-1 : apache2 - security update (httpoxy)

Scott Geary of VendHQ discovered that the Apache HTTPD server used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP...

Debian DLA-553-1 : apache2 security update (httpoxy)

Scott Geary of VendHQ discovered that the Apache HTTPD server used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP...

[SECURITY] [DLA 553-1] apache2 security update

Package : apache2 Version : 2.2.22-13+deb7u7 CVE ID : CVE-2016-5387 Scott Geary of VendHQ discovered that the Apache HTTPD server used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain...

[SECURITY] [DSA 3623-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3623-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 20, 2016 https://www.debian.org/security/faq -...

DSA-3623-1 apache2 - security update

Bulletin has no description...

openSUSE Security Update : apache2 (openSUSE-2016-880) (httpoxy)

This update for apache2 fixes the following issues : - It used to be possible to set an arbitrary $HTTPPROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request CVE-2016-5387. As a result, these server components would...

Debian Security Advisory DSA 3623-1 (apache2 - security update)

Scott Geary of VendHQ discovered that the Apache HTTPD server used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP...

Debian: Security Advisory (DSA-3623-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2016:1818-1 Security update for apache2

This update for apache2 fixes the following issues: It used to be possible to set an arbitrary $HTTPPROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request CVE-2016-5387. As a result, these server components would...

Vulnerabilities of the Debian GNU/Linux operating system, which allow a remote attacker to compromise the confidentiality and integrity of protected information

The rt3.4-apache2 package of the Debian GNU/Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to breaches of confidentiality and integrity of protected information. These vulnerabilities can be exploited remotely...

Vulnerabilities of the Debian GNU/Linux operating system, which allow a remote attacker to compromise the confidentiality and integrity of protected information

Multiple vulnerabilities exist in the rt3.6-apache2 package of the Debian GNU/Linux operating system. Exploitation of these vulnerabilities may lead to breaches of confidentiality and integrity of protected information. These vulnerabilities can be exploited remotely...

How to Exploit libphp7. 0. so in Apache2-vulnerability warning-the black bar safety net

Before foreign cattle were made portion of the blog Double Free in the Standard PHP Library Double Link List CVE-2 0 1 6-3 1 3 2 Their article details the vulnerability causes $var1=new SplStack; $var1-offsetSet1 0 0,new DateTime'2000-01-01'; //DateTime will be double-freed...

File upload vulnerability example analysis-vulnerability warning-the black bar safety net

Principles File upload is a Web application that often appear in the function,it allows users to upload files to the server and saved to a specific location. This security is a very sensitive issue, once the malicious program is uploaded to the server and get the Execute permission, the...

A Tale of openssl_seal(), PHP, and Apache2handle

Hey folks, The opensslseal 4 is prone to use uninitialized memory that can be turned into a code execution. This document describes technical details of our journey to hijack apache2 requests. What the heck is opensslseal? ... int opensslseal string $data , string &$sealeddata , array &$envkeys ,...

openSUSE Security Update : roundcubemail (openSUSE-2016-84)

Update to 1.0.8 - Add workaround for https://bugs.php.net/bug.php?id=70757 1490582 - Fix HTML sanitizer to skip in output 1490583 - Fix charset encoding of message/rfc822 part bodies 1490606 - Fix handling of message/rfc822 attachments on replies and forwards 1490607 - Fix PDF support detection i...

Security update for roundcubemail (important)

Update to 1.0.8 - Add workaround for https://bugs.php.net/bug.php?id=70757 1490582 - Fix HTML sanitizer to skip !-- node type X -- in output 1490583 - Fix charset encoding of message/rfc822 part bodies 1490606 - Fix handling of message/rfc822 attachments on replies and forwards 1490607 - Fix PDF...

openSUSE Security Update : roundcubemail (openSUSE-2015-722)

This update of roundcubemail fixes one security issue and one bug. - roundcubemail was updated to disallow unwanted access on files in the file system. The apache2 configuration file for roundcubemail previously allowed access to the roundcubemail/bin folder and possibly /logs, /config and /temp,...

openSUSE Security Update : roundcubemail (openSUSE-2015-699)

roundcubemail was updated to version 1.0.7 to fix two security issues. These security issues were fixed : - XSS issue in drag-n-drop file uploads - Disallow unwanted access on files in the file system. The apache2 configuration file for roundcubemail allowed access to the roundcubemail/bin folder...

SUSE SLES11 Security Update : apache2 (SUSE-SU-2015:1885-2)

Apache was updated to fix one security vulnerability and two bugs. Following security issue was fixed. - Fix the chunked transfer coding implementation in the Apache bsc938728, CVE-2015-3183 Bugs fixed : - add SSLSessionTickets directive bsc941676 - hardcode modules %files bsc444878 - only enable...