jbossws: Prone to character encoding pattern attack (XML Encryption flaw)

The W3C XML Encryption Standard, as used in the JBoss Web Services JBossWS component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining CBC mode, allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on...

Fedora 18 : php-pear-CAS-1.3.2-1.fc18 (2012-21084)

Changes in version 1.3.2 Security Fixes : - CVE-2012-5583 Missing CN validation of CAS server certificate 58 Joachim Fritschi Bug Fixes : - Fix broken character encoding in Greek and French 40 Joachim Fritschi - Minor error corrections in a few example files Joachim Fritschi - Remove erroneous...

Fedora 17 : php-pear-CAS-1.3.2-1.fc17 (2012-21106)

Changes in version 1.3.2 Security Fixes : - CVE-2012-5583 Missing CN validation of CAS server certificate 58 Joachim Fritschi Bug Fixes : - Fix broken character encoding in Greek and French 40 Joachim Fritschi - Minor error corrections in a few example files Joachim Fritschi - Remove erroneous...

Fedora 16 : php-pear-CAS-1.3.2-1.fc16 (2012-21122)

Changes in version 1.3.2 Security Fixes : - CVE-2012-5583 Missing CN validation of CAS server certificate 58 Joachim Fritschi Bug Fixes : - Fix broken character encoding in Greek and French 40 Joachim Fritschi - Minor error corrections in a few example files Joachim Fritschi - Remove erroneous...

CVE-2011-1096

CVE-2011-1096 affects the W3C XML Encryption usage in the JBoss Web Services CXF stack (jbossws-cxf) within JBoss Enterprise Portal Platform before 5.2.2 and other products. The root cause is CBC-mode block ciphers enabling a chosen-ciphertext attack on SOAP responses, allowing an attacker to rec...

CVE-2011-1096: Undefined Security Weakness

The W3C XML Encryption Standard, as used in the JBoss Web Services JBossWS component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining CBC mode, allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on...

thunderbird security update

CentOS Errata and Security Advisory CESA-2012:1483 An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring...

Improper character decoding in HZ-GB-2312 charset — Mozilla

Security researcher Masato Kinugawa found when HZ-GB-2312 charset encoding is used for text, the "" character will destroy another character near the chunk delimiter. This can lead to a cross-site scripting XSS attack in pages encoded in HZ-GB-2312...

jbossws: Prone to character encoding pattern attack (XML Encryption flaw)

The W3C XML Encryption Standard, as used in the JBoss Web Services JBossWS component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining CBC mode, allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on...

Microsoft Internet Explorer Multiple Vulnerabilities (2699988)

This host is missing a critical security update according to Microsoft Bulletin MS12-037. OpenVAS Vulnerability Test $Id: secpodms12-037.nasl 6526 2017-07-05 05:43:52Z cfischer $ Microsoft Internet Explorer Multiple Vulnerabilities 2699988 Authors: Rachana Shetty Copyright: Copyright c 2012 SecPo...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences with EUC-JP encoding, aka "EUC-JP Character Encoding Vulnerability."...

Debian DSA-2464-2 : icedove - several vulnerabilities

Several vulnerabilities have been discovered in Icedove, an unbranded version of the Thunderbird mail/news client. - CVE-2012-0467 Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay discovered memory...

DSA-2464-1 icedove - several

Bulletin has no description...

Debian DSA-2457-2 : iceweasel - several vulnerabilities

Several vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox. The included XULRunner library provides rendering services for several other applications included in Debian. - CVE-2012-0467 Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hal...

Debian DSA-2458-2 : iceape - several vulnerabilities

Several vulnerabilities have been found in the Iceape internet suite, an unbranded version of SeaMonkey : - CVE-2012-0455 Soroush Dalili discovered that a cross-site scripting countermeasure related to JavaScript URLs could be bypassed. - CVE-2012-0456 Atte Kettunen discovered an out of bounds re...

DSA-2458-1 iceape - several

Bulletin has no description...

DSA-2457-1 iceweasel - several

Bulletin has no description...

John the Ripper 1.7.8-jumbo-7 Released

John the Ripper 1.7.8-jumbo-7 Released Change Log : Support for encrypted pkzip archives has been added, testing millions of candidate passwords per second. JimF This is in addition to WinZip/AES archives, support for which was added in prior -jumbo updates. Support for Mac OS X 10.7 Lion salted...

John the Ripper 1.7.8-jumbo-7 Released

John the Ripper 1.7.8-jumbo-7 Released Change Log : Support for encrypted pkzip archives has been added, testing millions of candidate passwords per second. JimF This is in addition to WinZip/AES archives, support for which was added in prior -jumbo updates. Support for Mac OS X 10.7 Lion salted...

CVE-2011-1962

Microsoft Internet Explorer 6 through 9 does not properly handle unspecified character sequences, which allows remote attackers to read content from a different 1 domain or 2 zone via a crafted web site that triggers "inactive filtering," aka "Shift JIS Character Encoding Vulnerability."...