1545 matches found
Fedora 26 : 1:tomcat (2018-a233dae4ab)
This update includes a rebase from 8.0.49 up to 8.0.50 which resolves two CVEs along with various other bugs/features : - rhbz1548290CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unitended exposure of resources - rhbz1548284 CVE-2018-1305 tomcat:...
Fedora 26 : 3:mariadb (2018-02c0e3725e)
MariaDB 10.1.32 Release notes : https://mariadb.com/kb/en/library/mariadb-10131-release-notes/ https://mariadb.com/kb/en/library/mariadb-10132-release-notes/ Bugs solved : Jemalloc issue on aarch64 solved in jemalloc package https://bugzilla.redhat.com/showbug.cgi?id=1545539 CVEs fixed :...
Fedora 27 : chromium (2018-faff5f661e)
The remote Fedora 27 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2018-faff5f661e advisory. Update to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs. CVE-2017-15396...
Fedora 26 : qt5-qtwebengine (2018-024afa2d48)
A QtWebEngine security update backporting security fixes from Chromium 65 up to 65.0.3325.146. The backports have been forward-ported from QtWebEngine 5.9.5 LTS. This update fixes the following security issues : - CVE-2017-15429 - CVE-2018-6033 claimed fixed in 5.10.1, but the fix was incomplete...
USN-3593-1: Zsh vulnerabilities
It was discovered that Zsh incorrectly handled certain enviroment variables. An attacker could possibly use this issue to gain privileged access to the system. This issue only affected Ubuntu 14.04 LTS. CVE-2014-10070 It was discovered that Zsh incorrectly handled certain inputs. An attacker coul...
Internet Bug Bounty: Two vulnerability in GNU binutils
Last year, I submitted a bug to GNU and applied for two cve: https://vulners.com/cve/CVE-2017-12799 https://vulners.com/cve/CVE-2017-12967 Impact denial of service or leak information...
Security update for openssl-steam (important)
This update for openssl-steam fixes the following issues: - Merged changes from upstream openssl Factory rev 137 into this fork for Steam. Updated to openssl 1.0.2k: CVE-2016-7055: Montgomery multiplication may produce incorrect results boo1009528 CVE-2016-7056: ECSDA P-256 timing attack key...
Threat Analysis: Pylot (Travle) Malware Family
The Pylot or Travle malware family appears to be an evolution of the NetTravler malware family which has been linked to attackers out of China by numerous sources. Over the last year a variant has been observed as a secondary payload often used in conjunction with malicious carrier files typicall...
Fedora 27 : chromium (2017-f2f3fa09e3)
Security fix for CVE-2017-15398, CVE-2017-15399 ---- Security fix for CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127. Build switched to us...
SUSE-SU-2018:0079-1 Security update for mariadb
This update for mariadb fixes several issues. These security issues were fixed: - CVE-2017-3636: Client programs had an unspecified vulnerability that could lead to unauthorized access and denial of service bsc1049399 - CVE-2017-3641: DDL unspecified vulnerability could lead to denial of service...
EulerOS 2.0 SP1 : kernel (EulerOS-SA-2018-1002)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The recent speculative execution CVEs address three potential attacks across a wide variety of architectures and hardware platforms. - Note: Thi...
CVE-2017-17431
GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761, CVE-2017-14762, or CVE-2017-14765...
QEMU - NBD Server Long Export Name Stack Buffer Overflow
Introduced in commit f37708f6b8 2.10. The NBD spec says a client can request export names up to 4096 bytes in length, even though they should not expect success on names longer than 256. However, qemu hard-codes the limit of 256, and fails to filter out a client that probes for a longer name; the...
Fedora 26 : cacti (2017-9762a831b2)
Update to 1.1.28 - CVE-2017-16641, CVE-2017-16660, CVE-2017-16661, CVE-2017-16785 Release notes: https://www.cacti.net/releasenotes.php?version=1.1.28 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...
Intel Patches CPU Bugs Impacting Millions of Devices
Intel released patches on Monday to protect millions of PCs and servers from vulnerabilities found in its Management Engine, Trusted Execution Engine and Server Platform Services that could allow local attackers elevate privileges, run arbitrary code, crash systems and eavesdrop on communications...
[SECURITY] [DLA 1144-1] git-annex security update
Package : git-annex Version : 3.20120629+deb7u1 CVE ID : CVE-2017-12976 Debian Bug : 873088 git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related...
The best Burp plugin I’ve ever seen
Wanted to share with you what IMHO is the most promising Burp Suite plugin that just might transform it to the best penetration tool ever. It’s the Vulners plugin, available for free at github . If you are lazy like me, a build is available here: Installation It’s easy if you know how to deal wit...
EllaScanner - Passive Web Scanner
Passive web scanner. EllaScanner is a simple passive web scanner. Using this tool you can simply check your site’s security state. Usage: ./Start.py https:// or http:// Scanning of the site consists several phases: At the first phase, you can get recommendations related to http/https headers. The...
FreeBSD : xorg-server -- multiple vulnabilities (7274e0cc-575f-41bc-8619-14a41b3c2ad0)
Adam Jackson reports : One regression fix since 1.19.4 mea culpa, and fixes for CVEs 2017-12176 through 2017-12187. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018...
