Cisco Wireless LAN Controller IPv6 Packet Handling Denial of Service Vulnerability

A vulnerability in Cisco Wireless LAN Controller WLC devices could allow an unauthenticated, adjacent attacker could to cause a crash of an affected device. The vulnerability exists due to an unhandled exception that may occur when IPv6 traffic is forwarded to a device that is not configured for...

Retrospect Backup Client uses weak password hashing

Overview Retrospect Backup Client is a client to a network-based backup utility. This client stores passwords in a hashed format that is weak and susceptible to collision, allowing an attacker to generate a password hash collision and gain access to the target's backup files. Description CWE-916:...

Facebook Requires SHA-2 Support as of Oct. 1, 2015

Facebook has put developers on notice that as of Oct. 1, apps that do not support SHA-2 will no longer connect to its network. With Tuesday’s announcement, the tech giant has fallen in line alongside Google, Mozilla and Microsoft in deprecating the SHA-1 and older hash algorithms. “These changes...

Cisco TelePresence Authentication Bypass Elevation of Privilege Vulnerability

Cisco TelePresence is a telepresence conferencing solution developed by Cisco. A security vulnerability exists in Cisco TelePresence TC and TE that allows a remote user in a broadcast or collision domain or a local user with physical access to bypass authentication and gain ROOT privileges...

Cisco IOS Voice Gateway Malformed ISDN Q931 Message Denial of Service Vulnerability

A vulnerability in the Integrated Services Digital Network ISDN processing code of Cisco IOS could allow an unauthenticated, adjacent attacker to cause a reload of the affected device. The vulnerability is due to improper processing of malformed ISDN Q931 SETUP messages. An attacker could exploit...

Debian DLA-209-1 : jruby security update

JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted input to an application that maintains a hash table. Note: This update includes...

DLA-209-1 jruby - security update

Bulletin has no description...

A Tale of Two Exploits

Posted by Natalie Silvanovich, Collision Investigator and Object Field Examiner CVE-2015-0336 is a type confusion vulnerability in the AS2 NetConnection class. I reported this issue in January and soon wrote a proof-of-concept exploit for the bug. The issue was patched by Adobe in March and less...

DEBIAN-CVE-2015-1421

Use-after-free vulnerability in the sctpassocupdate function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service slab corruption and panic or possibly have unspecified other impact by triggering an INIT collision that leads to improper...

Design/Logic Flaw

Use-after-free vulnerability in the sctpassocupdate function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service slab corruption and panic or possibly have unspecified other impact by triggering an INIT collision that leads to improper...

CVE-2015-1421

Use-after-free vulnerability in the sctpassocupdate function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service slab corruption and panic or possibly have unspecified other impact by triggering an INIT collision that leads to improper...

CVE-2015-1421

Use-after-free vulnerability in the sctpassocupdate function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service slab corruption and panic or possibly have unspecified other impact by triggering an INIT collision that leads to improper...

UBUNTU-CVE-2015-1421

Use-after-free vulnerability in the sctpassocupdate function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service slab corruption and panic or possibly have unspecified other impact by triggering an INIT collision that leads to improper...

librsync: checksum collision

librsync previously used a truncated MD4 "strong" check sum to match blocks. However, MD4 is not cryptographically strong. It's possible that an attacker who can control the contents of one part of a file could use it to control other regions of the file, if it's transferred using librsync/rdiff...

CVE-2015-1421

Use-after-free vulnerability in the sctpassocupdate function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service slab corruption and panic or possibly have unspecified other impact by triggering an INIT collision that leads to improper...

Microsoft SHA-2 Advisory Causing 'Infinite Loop' Issues

Problems with a security update issued this week by Microsoft have surfaced on a number of technology forums. Windows users say Microsoft Security Advisory 303929, which adds SHA-2 code-signing and verification support for Windows 7 client machines and Windows Server 2008 R2 boxes, is causing...

WordPress 3.7 < 3.7.5 / 3.8 < 3.8.5 / 3.9 < 3.9.3 / 4.x < 4.0.1 Multiple Vulnerabilities

Binary data 8584.prm...

Google Pwnium Program Now Open All Year

Google is expanding its successful Pwnium vulnerability reward program–which has run at various security conferences for a couple of years now–to run continuously and offer an unlimited pool of financial rewards. Pwnium originally was established as an alternative to the Pwn2Own hacking contest a...

Cisco Wireless LAN Controller Denial of Service Vulnerability

A vulnerability in the wireless intrusion detection WIDS feature of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, remote attacker to force the WLC to become unresponsive. For a Cisco WLC with a default configuration, the attacker could exploit this vulnerability by sending...

PT-2015-1017 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Linux kernel versions prior to 3.18.8 Ubuntu linux-image-3.16.0 Ubuntu linux-image-3.2.0 Description: The issue concerns multiple vulnerabilities in the Linux kernel, specifically affecting Red Hat Enterprise Linux and...