Ubuntu: Security Advisory (USN-1955-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for apt-xapian-index USN-1955-1

Check for the Version of apt-xapian-index OpenVAS Vulnerability Test $Id: gbubuntuUSN19551.nasl 8456 2018-01-18 06:58:40Z teissa $ Ubuntu Update for apt-xapian-index USN-1955-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This progr...

Ubuntu 12.04 LTS / 12.10 / 13.04 : apt-xapian-index vulnerability (USN-1955-1)

It was discovered that apt-xapian-index was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenab...

USN-1955-1: apt-xapian-index vulnerability

It was discovered that apt-xapian-index was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations...

CVE-2013-1064

apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2...

Debian Security Advisory DSA 2585-1 (bogofilter - buffer overflow)

A heap-based buffer overflow was discovered in bogofilter, a software package for classifying mail messages as spam or non-spam. Crafted mail messages with invalid base64 data could lead to heap corruption and, potentially, arbitrary code execution. OpenVAS Vulnerability Test $Id: deb25851.nasl...

Debian Security Advisory DSA 2591-1 (mahara - several vulnerabilities)

Multiple security issues have been found in Mahara, an electronic portfolio, weblog, and resume builder, which can result in cross-site scripting, clickjacking or arbitrary file execution. OpenVAS Vulnerability Test $Id: deb25911.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from...

Debian Security Advisory DSA 2462-2 (imagemagick - several vulnerabilities)

Several integer overflows and missing input validations were discovered in the ImageMagick image manipulation suite, resulting in the execution of arbitrary code or denial of service. OpenVAS Vulnerability Test $Id: deb24622.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory D...

CVE-2013-2176

Unquoted Windows search path vulnerability in the Red Hat Enterprise Virtualization Application Provisioning Tool RHEV-APT in the rhev-guest-tools-iso package 3.2 allows local users to gain privileges via a Trojan horse application...

Design/Logic Flaw

Unquoted Windows search path vulnerability in the Red Hat Enterprise Virtualization Application Provisioning Tool RHEV-APT in the rhev-guest-tools-iso package 3.2 allows local users to gain privileges via a Trojan horse application...

CVE-2013-2176

Unquoted Windows search path vulnerability in the Red Hat Enterprise Virtualization Application Provisioning Tool RHEV-APT in the rhev-guest-tools-iso package 3.2 allows local users to gain privileges via a Trojan horse application...

CVE-2013-2176

CVE-2013-2176 is an unquoted Windows search path vulnerability in the Red Hat Enterprise Virtualization Application Provisioning Tool (RHEV-APT) installed via rhev-guest-tools-iso (v3.2). The unquoted path could allow a local, unprivileged user to have a Trojan horse binary executed with SYSTEM p...

Aumlib, Ixeshe Malware Updated in Targeted China Attacks

After a quiet period, the state-sponsored hacker group blamed for attacks on the New York Times late last year has begun a number of new campaigns that feature updated versions of malware used in attacks going back to 2009. Researchers at FireEye said the group, identified as APT 12 by forensics...

Watering-Hole Attack Compromises Key Tibetan Site

In what has become a familiar scenario over the last couple of years, attackers have compromised a key Tibetan web site and loaded it with code that redirects some users to a third-party site that installs an APT-style backdoor. The attack has hit the Web site of the Central Tibetan Administratio...

Important: Red Hat Security Advisory: rhev-guest-tools-iso security and bug fix update

An updated rhev-guest-tools-iso package that fixes one security issue and two bugs is now available. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Debian Security Advisory DSA 2727-1 (openjdk-6 - several vulnerabilities)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service. OpenVAS Vulnerability Test $Id: deb2727.nasl 6611 2017-07-07 12:07:20Z...

Debian Security Advisory DSA 2719-1 (poppler - several vulnerabilities)

Multiple vulnerabilities were discovered in the poppler PDF rendering library. CVE-2013-1788 Multiple invalid memory access issues, which could potentially lead to arbitrary code execution if the user were tricked into opening a malformed PDF document. CVE-2013-1790 An uninitialized memory issue,...

njRAT Attacks Spike Against Middle East High-Value Targets

Government agencies, telecom and energy organizations in the Middle East are being targeted by espionage malware known as njRAT. The remote access Trojan is thorough in its data-stealing capabilities. Beyond dropping a keylogger, variants are capable of accessing a computer’s camera, stealing...

Stolen Opera Code-Signing Certificate Used to Sign Malware

Opera Software said it was able to contain the impact of a security breach that resulted in the theft of an expired code-signing certificate used to sign malware distributed to Windows users during a 36-minute stretch on June 19. Opera developer Sigbjorn Vik said the browser maker was victimized ...

Researchers Uncover PinkStats APT Toolkit

The arsenal of tools that attack groups use to do their business is seemingly endless, and many of them remain unknown for years before they’re discovered. Often, it’s not until a tool has been compromised or sold on the open market that researchers get a close look at it, but that’s been changin...