[ASA-201611-28] ntp: multiple issues

Arch Linux Security Advisory ASA-201611-28 ========================================== Severity: High Date : 2016-11-26 CVE-ID : CVE-2016-7426 CVE-2016-7427 CVE-2016-7428 CVE-2016-7429 CVE-2016-7431 CVE-2016-7433 CVE-2016-7434 CVE-2016-9310 CVE-2016-9311 Package : ntp Type : multiple issues Remote...

CVE-2016-7433

A flaw was found in the way ntpd calculated the root delay. A remote attacker could send a specially-crafted spoofed packet to cause denial of service or in some special cases even crash...

DEBIAN-CVE-2016-9375

In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DTN dissector could go into an infinite loop, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dtn.c by checking whether SDNV evaluation was successful...

UBUNTU-CVE-2016-9375

In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DTN dissector could go into an infinite loop, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dtn.c by checking whether SDNV evaluation was successful...

389-ds-base security, bug fix, and enhancement update

1.2.11.15-84 - Release 1.2.11.15-84 - Resolves: 1376676 - Backport AES storage scheme plugin DS 47462 1.2.11.15-83 - Release 1.2.11.15-83 - Resolves: 1376676 - Backport AES storage scheme plugin DS 47462 1.2.11.15-82 - Release 1.2.11.15-82 - Resolves: 1376676 - Backport AES storage scheme plugin ...

Google and double 叒 叕 exposure Windows 0day vulnerabilities, Microsoft is not happy-vulnerability warning-the black bar safety net

Google recently again exposed the Windows 0day vulnerabilities, that the vulnerability can affect all current Windows operating systems, and Microsoft hasn't had time to fix. ! According to the Google team released a blog post that the vulnerability is a local mention the right vulnerability, it...

history.com XSS vulnerability

Open Bug Bounty ID: OBB-188284 Description| Value ---|--- Affected Website:| history.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Joomla jVoteSystem 2.56 Component parameter keyword time delay injection vulnerability

No description provided by source...

The vulnerability of the Firefox browser allows a malicious actor to trigger the unintended execution of a loaded file.

The Mozilla Firefox browser contains a vulnerability related to an error in file loading, caused by an improper limitation on the time delay for button selections. Exploiting this vulnerability allows malicious actors to remotely replace the interface/cursor and trigger the unintended execution o...

The vulnerability of the Mozilla SeaMonkey software package, which allows a malicious actor to bypass domain restriction rules

The Mozilla SeaMonkey browser contains a vulnerability related to errors in the implementation of class functions. Exploiting this vulnerability allows malicious actors to circumvent domain restriction policies SOP and gain access to confidential information through the use of IFRAME elements and...

The vulnerability of the Mozilla SeaMonkey software package, which allows a malicious individual to trigger unintended execution of a loaded file

Mozilla SeaMonkey software contains a vulnerability related to an error in file loading, caused by an improper limitation on the time delay for button selections. Exploiting this vulnerability allows malicious actors to remotely replace the interface/cursor and trigger the unintended execution of...

WebSummit: Time Based SQL injection in url parameter

There is possibility of inducing some time delay in the "url" parameter of the videos.websummit.com using the Benchmark and SQL queries, which could result in timeout for application upon huge delay induced into the application...

openSUSE Security Update : dropbear (openSUSE-2016-387)

dropbear was updated to 2016.72 to fix the following issues : Changes in dropbear : - updated to upstream version 2016.72 - Validate X11 forwarding input. Could allow bypass of authorizedkeys command= restrictions, found by github.com/tintinweb. Thanks for Damien Miller for a patch. - used as bug...

FreeBSD : mozilla -- multiple vulnerabilities (4f00dac0-1e18-4481-95af-7aaad63fd303)

Mozilla Foundation reports : MFSA 2016-01 Miscellaneous memory safety hazards rv:44.0 / rv:38.6 MFSA 2016-02 Out of Memory crash when parsing GIF format images MFSA 2016-03 Buffer overflow in WebGL after out of memory allocation MFSA 2016-04 Firefox allows for control characters to be set in cook...

peoplesbookprize.com XSS vulnerability

Open Bug Bounty ID: OBB-130498 Description| Value ---|--- Affected Website:| peoplesbookprize.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Missing delay following user click events in protocol handler dialog — Mozilla

Security researcher window reported an issue where the protocol handler dialog appears, double click events are treated as two single click events. This was caused by the lack of a delay following the initial focus in the file download dialog. This could cause a second dialog to be sent the secon...

Udemy: CSRF in Udemy.com

The investigator removed cookies that are not used by our site and thought he had found a bypass. We were greatly delayed in getting this response to him...

Microsoft Office COM Object - DLL Planting with comsvcs.dll Delay Load of mqrt.dll (MS15-132)

Microsoft Office COM Object - DLL Planting with comsvcs.dll Delay Load of mqrt.dll MS15-132 Source: https://code.google.com/p/google-security-research/issues/detail?id=556 It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially...

KLA10703 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, spoof user interface, bypass security restrictions or execute arbitrary code. Below is a complete list of vulnerabilities 1. Improper array elements...

curl, libcurl security update

CentOS Errata and Security Advisory CESA-2015:2159 Updated curl packages that fix multiple security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common...