DEBIAN-CVE-2014-0139

cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name CN field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certifica...

IP address wildcard certificate validation

libcurl incorrectly validates wildcard SSL certificates containing literal IP addresses. RFC 2818 covers the requirements for matching Common Names CNs and subjectAltNames in order to establish valid SSL connections. It first discusses CNs that are for hostnames, and the rules for wildcards in th...

[SECURITY] Fedora 19 Update: catfish-0.4.0.2-4.fc19

A handy file search tool using different backends which is configurable via the command line. This program acts as a frontend for different file search engines. The interface is intentionally lightweight and simple. But it takes configuration options from the command line...

Fedora Update for cups-filters FEDORA-2014-3738

Check for the Version of cups-filters OpenVAS Vulnerability Test Fedora Update for cups-filters FEDORA-2014-3738 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

UBUNTU-CVE-2013-7075

The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an...

CVE-2013-0181

Cross-site scripting XSS vulnerability in Views in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...

XML Parsing Vulnerability affecting JRuby users

The ActiveSupport XML parsing functionality supports multiple pluggable backends. One backend supported for JRuby users is ActiveSupport::XmlMiniJDOM which makes use of the javax.xml.parsers.DocumentBuilder class. In some JVM configurations the default settings of that class can allow an attacker...

CVE-2013-0333: Undefined Security Weakness

lib/activesupport/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication v...

Fedora Update for rubygem-multi_xml FEDORA-2013-0839

Check for the Version of rubygem-multixml OpenVAS Vulnerability Test Fedora Update for rubygem-multixml FEDORA-2013-0839 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modi...

Fedora Update for rubygem-multi_xml FEDORA-2013-0808

Check for the Version of rubygem-multixml OpenVAS Vulnerability Test Fedora Update for rubygem-multixml FEDORA-2013-0808 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modi...

Ruby on Rails 3.0 and 2.3 JSON Parser vulnerability

Overview The Ruby on Rails 3.0 and 2.3 JSON parser contain a vulnerability that may result in arbitrary code execution. Description The Ruby on Rails advisory states:There is a vulnerability in the JSON code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitra...

[SECURITY] Fedora 17 Update: rubygem-multi_xml-0.4.1-4.fc17

A gem to provide swappable XML backends utilizing LibXML, Nokogiri, Ox, or REXML...

SuSE 10 Security Update : CUPS (ZYPP Patch Number 7775)

This update fixes the following security issues : - 601830: CSRF via admin web interface. CVE-2010-0540 - 680210: users in group 'lp' can overwrite arbitrary files. CVE-2010-2431 - 711490: heap overflow in gif decoder. CVE-2011-2896 - 715643: heap overflow in gif decoder CVE-2011-3170 This update...

Fedora 14 : krb5-1.8.4-3.fc14 (2011-14650)

This update applies the upstream patch to fix a NULL pointer dereference wi= th the LDAP kdb backend CVE-2011-1527, an assertion failure with multiple= kdb backends CVE-2011-1528, and a NULL pointer dereference with multiple= kdb backends CVE-2011-1529. 737711...

Fedora 15 : krb5-1.9.1-14.fc15 (2011-14673)

This update applies the upstream patch to fix a NULL pointer dereference wi= th the LDAP kdb backend CVE-2011-1527, 744125, an assertion failure with= multiple kdb backends CVE-2011-1528, and a NULL pointer dereference with= multiple kdb backends CVE-2011-1529. 737711 It also rolls up a number of...

xen security and bug fix update

3.0.3-132.el57.2 - Release device backends before restarting guest on the destination machine rhbz 743850 - Fix SCSI buffer overflow and disable SCSI CD-ROMs rhbz 736289 3.0.3-132.el57.1 - hotplug: set netback/tap MTU to the same value as the bridge MTU rhbz 738608 - copy the MTU of the physical...

MIT krb5 FTP server privilege escalation

Daemon group privileges are not dropped. DoS conditions in different backends...

SuSE 11.1 Security Update : krb5 (SAT Patch Number 3839)

Multiple KDC DoS vulnerabilities if used with LDAP backends have been fixed in krb5. CVE-2011-0281 / CVE-2011-0282 have been assigned. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The te...

[SECURITY] Fedora 13 Update: sssd-1.2.2-21.fc13

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the basis to provide client auditing and policy servic...

Mandriva Update for sane MDVA-2010:134 (sane)

Check for the Version of sane OpenVAS Vulnerability Test Mandriva Update for sane MDVA-2010:134 sane Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...