ansible -- information disclosure flaw

ansible developers report: Ansible versions 2.2.3 and earlier are vulnerable to an information disclosure flaw due to the interaction of call back plugins and the nolog directive where the information may not be sanitized properly...

Fedora 26 : ntp (2017-20d54b2782)

Security fix for CVE-2017-6464 CVE-2017-6462 CVE-2017-6463 CVE-2017-6458 CVE-2017-6451 CVE-2017-6460 CVE-2016-9042. ---- This update improves the default configuration file to use the pool directive. It also replaces the ntpstat program with a shell script that uses the ntpq program instead of...

RHEL 6 : httpd (RHSA-2017:1721)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:1721 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: It was discovered that the HTTP...

Information Disclosure

ansible is vulnerable to information disclosure. It is possible because .result attribute of an ansible.executor.taskresult.TaskResult is being sent to the callback plugins without obscuring stdout information when using a nolog directive...

httpd: Incomplete handling of LimitRequestFields directive in mod_http2

A vulnerability was found in httpd's handling of the LimitRequestFields directive in modhttp2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server's available memory, causing httpd to crash...

allows remote attackers to cause a denial of service (CVE-2017-6464)

Security Advisory ID : BSA-2017-287 Component : NTP Revision : 1.0: Interim NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service ntpdcrash via a malformed mode configuration directive. Affected Products Brocade is investigating its product lines to...

BSA-2017-289

Security Advisory ID : BSA-2017-289 Component : NTP Revision : 1.0: Interim A vulnerability found in the NTP server allows an authenticated remote attacker to crash the daemon by sending an invalid setting viathe :configdirective. Theunpeeroption expects a number or an address as an argument. In...

CVE-2017-7473

Ansible versions 2.2.3 and earlier are vulnerable to an information disclosure flaw due to the interaction of call back plugins and the nolog directive information may not be sanitized properly...

Misconfiguration in LIMIT directive of .htaccess file

There are a number of HTTP methods that can be used on a webserver for example OPTIONS, HEAD, GET, POST, PUT, DELETE etc.. Each of these methods perform a different function, and each has an associated level of risk when their use is permitted on the webserver. The directive within Apache's...

DEBIAN-CVE-2017-6464

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service ntpd crash via a malformed mode configuration directive...

UBUNTU-CVE-2017-6463

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service daemon crash via an invalid setting in a :config directive, related to the unpeer option...

CVE-2017-6463

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service daemon crash via an invalid setting in a :config directive, related to the unpeer option...

UBUNTU-CVE-2017-6464

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service ntpd crash via a malformed mode configuration directive...

NTP Denial of Service Vulnerability (CNVD-2017-04414)

NTP is Network Time Protocol NTP, which is a protocol used to synchronize the time of individual computers on a network. NTP has a denial-of-service vulnerability that can be exploited by an attacker to cause a denial of service daemon crash via an invalid setting in the :config directive...

SUSE-SU-2017:0801-1 Security update for apache2

This update for apache2 provides the following fixes: Security issues fixed: - CVE-2016-0736: Protect modsessioncrypto data with a MAC to prevent padding oracle attacks bsc1016712. - CVE-2016-2161: Malicious input to modauthdigest could have caused the server to crash, resulting in DoS bsc1016714...

GDPR Series, Part 4: The Penalties for Non-Compliance

In the first three parts of this series, we covered the GDPR basics: who is subject to the GDPR requirements, what rules require data protection technology, and how you can start preparing your organization for the regulation. In this final installment, we will cover what happens when you are not...

CVE-2016-2516

NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service ntpd abort by using the same IP address multiple times in an unconfig directive...

DEBIAN-CVE-2016-2516

NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service ntpd abort by using the same IP address multiple times in an unconfig directive...

Fedora 24 : phpMyAdmin (2016-2424eeca35)

phpMyAdmin 4.6.5.1 2016-11-26 =============================== A patch-level release fixing two small issues : - an issue affecting a small number of users using $cfg'Servers'$i'hidedb' or $cfg'Servers'$i'onlydb'. - an issue affecting the create table dialog where the partition selection tool was...

CVE-2016-6629

An issue was discovered in phpMyAdmin involving the $cfg'ArbitraryServerRegexp' configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x...