Transmission - RPC DNS Rebinding

Transmission - RPC DNS Rebinding The transmission bittorrent client uses a client/server architecture, the user interface is the client and a daemon runs in the background managing the downloading, seeding, etc. Clients interact with the daemon using JSON RPC requests to a web server listening on...

CVE-2018-0002

On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashes of the flowd daemon which results in...

USN-3526-1 sssd vulnerability

It was discovered that SSSD incorrectly handled certain inputs when querying its local cache. An attacker could use this to inject arbitrary code and expose sensitive information...

[SECURITY] Fedora 26 Update: xen-4.8.2-9.fc26

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

Updated heimdal packages fix security vulnerability

Michael Eder and Thomas Kittel discovered that Heimdal did not correctly handle ASN.1 data. This would allow an unauthenticated remote attacker to cause a denial of service crash of the KDC daemon by sending maliciously crafted packets CVE-2017-17439...

CVE-2017-17877

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet with stateless address autoconfiguration by default, which makes it easier for remote attackers to obtain access by...

Design/Logic Flaw

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet with stateless address autoconfiguration by default, which makes it easier for remote attackers to obtain access by...

Amazon Linux AMI : exim (ALAS-2017-932)

Use-after-free in receivemsg function via vectors involving BDAT commands The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service use-after-free via vectors involving BDAT commands. CVE-2017-16943...

The vulnerability of the `csnmp_read_table` function in the SNMP plugin for the Collectd daemon allows a attacker to cause an application to terminate abnormally.

The vulnerability of the csnmpreadtable function snmp.c in the SNMP plugin for Collectd is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to cause the application to crash remotely or cause other adverse effects...

CVE-2017-17877

The CVE-2017-17877 entry concerns Valve Steam Link (build 643). When the SSH daemon is enabled for local development, the device becomes publicly reachable via IPv6 TCP port 22 over the internet by default, enabling remote access by guessing 24 bits of the MAC address and attempting a root login....

MGASA-2017-0458 Updated dhcp packages fix security vulnerability

It was found that the DHCP daemon does not free socket descriptors when handling empty OMAPI messages. An adjacent network attacker could potentially use this flaw to send crafted OMAPI messages to the DHCP daemon, thereby leading to denial of service due to exhaustion of file descriptors in the...

Updated rsync package fixes security vulnerability

The receivexattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service heap-based buffer over-read and application crash or possibly have unspecified other impact by sendi...

F5 Networks BIG-IP : NTP vulnerability (K02951273)

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service daemon crash via an invalid setting in a :config directive, related to the unpeer option. CVE-2017-6463 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

Critical: exim

Issue Overview: Use-after-free in receivemsg function via vectors involving BDAT commands The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service use-after-free via vectors involving BDAT commands...

rsync -- multiple vulnerabilities

Jeriko One reports: The receivexattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service heap-based buffer over-read and application crash or possibly have unspecified...

MGASA-2017-0449 Updated deluge packages fix security vulnerability

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template fileCVE-2017-9031. Updated deluge package adds systemd services required to autostart deluge daemon and web service...

Updated rsync package fixes security vulnerabilities

The recvfiles function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemonfilterlist data structure, which allows remote attackers to bypass intended access restrictions...

Updated deluge packages fix security vulnerability

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template fileCVE-2017-9031. Updated deluge package adds systemd services required to autostart deluge daemon and web service...

i2pd and kovri information disclosure vulnerabilities

i2p is a network protocol for encryption that enables anonymous access to the Internet. i2pd is a C++ implementation of the i2p client. kovri is a lightweight i2p-compatible router. A security vulnerability exists in i2pd versions prior to 2.17 and in the kovri pre-alpha version, which stems from...

CVE-2017-17434

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemonfilterlist data structure in the recvfiles function in receiver.c and also does not apply the sanitizepaths protection mechanism to pathnames found in "xname follows" strings in...