Moderate: Red Hat Security Advisory: qpid-cpp security and bug fix update

Updated qpid-cpp packages that fix multiple security issues and one bug are now available for Red Hat Enterprise MRG Messaging 2.5 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base score...

qpid-cpp: anonymous access to qpidd cannot be prevented

It was discovered that the Qpid daemon qpidd did not restrict access to anonymous users when the ANONYMOUS mechanism was disallowed...

Google Chrome Blink Denial of Service Vulnerability (CNVD-2015-00709)

Google Chrome is a popular WEB browser. A vulnerability in the font implementation of the RenderTable::simplifiedNormalFlowLayout function in Google Chrome Blink core/rendering/RenderTable.cpp allows attackers to construct malicious WEB pages that can be tricked into being parsed by the user,...

CVE-2014-2208

The vulnerability CVE-2014-2208 affects Facebook HHVM prior to version 2.4.2. A CRLF injection in the LightProcess protocol implementation (hphp/util/light-process.cpp) allows remote attackers to cause arbitrary command execution by injecting a newline character before the end of a string. Affect...

UBUNTU-CVE-2014-9351

engine/server/server.cpp in Teeworlds 0.6.x before 0.6.3 allows remote attackers to read memory and cause a denial of service crash via unspecified vectors...

Fedora Update for qpid-cpp FEDORA-2014-14564

Check the version of qpid-cpp SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868492";...

Fedora 19 : qpid-cpp-0.26-12.fc19 (2014-14564)

QPID-6218: Prevent the broker from access external resources. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

[SECURITY] Fedora 19 Update: qpid-cpp-0.26-12.fc19

Run-time libraries for AMQP client applications developed using Qpid C++. Clients exchange messages with an AMQP message broker using the AMQP protocol...

UBUNTU-CVE-2014-3178

Use-after-free vulnerability in core/dom/Node.cpp in Blink, as used in Google Chrome before 37.0.2062.120, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of render-tree inconsistencies...

UBUNTU-CVE-2014-1567

Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the...

CVE-2014-1725: Improper Input Validation

The base64DecodeInternal function in wtf/text/Base64.cpp in Blink, as used in Google Chrome before 34.0.1847.116, does not properly handle string data composed exclusively of whitespace characters, which allows remote attackers to cause a denial of service out-of-bounds read via a window.atob...

PT-2014-1044

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 34.0.1847.116 Description The issue is related to the incorrect handling of string data consisting only of whitespace characters in the base64DecodeInternal function in wtf/text/Base64.cpp in Blink. This allows...

UBUNTU-CVE-2013-4234

Multiple heap-based buffer overflows in the 1 abcMIDIdrum and 2 abcMIDIgchord functions in loadabc.cpp in libmodplug 0.8.8.4 and earlier allow remote attackers to cause a denial of service memory corruption and crash and possibly execute arbitrary code via a crafted ABC...

CVE-2013-2901: Undefined Security Weakness

Multiple integer overflows in 1 libGLESv2/renderer/Renderer9.cpp and 2 libGLESv2/renderer/Renderer11.cpp in Almost Native Graphics Layer Engine ANGLE, as used in Google Chrome before 29.0.1547.57, allow remote attackers to cause a denial of service or possibly have unspecified other impact via...

PT-2013-4019

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 29.0.1547.57 Description The issue is related to multiple integer overflows in the Almost Native Graphics Layer Engine ANGLE, specifically in the libGLESv2/renderer/Renderer9.cpp and...

CVE-2013-2156: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the Exclusive Canonicalization functionality xsec/canon/XSECC14n20010315.cpp in Apache Santuario XML Security for C++ aka xml-security-c before 1.7.1 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted PrefixLi...

DEBIAN-CVE-2012-6129

Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted "micro transport protocol packets."...

qpid-cpp: qpid authentication bypass

It was found that the Apache Qpid daemon qpidd treated AMQP connections with the federationtag attribute set as a broker-to-broker connection, rather than a client-to-server connection. This resulted in the source user ID of messages not being checked. A client that can establish an AMQP connecti...

qpid-cpp: long arrays of zero-width types cause a denial of service

The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service memory consumption and server crash via a large number of zero width elements in the client-properties map in a connection.start-ok message...

qpid-cpp: crash due to qpid::framing::Buffer::checkAvailable() wraparound

Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service crash via a crafted message, which triggers an out-of-bounds read...