SUSE-SU-2016:0119-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature bsc961642 - CVE-2016-0778: A malicious or compromised server could could trigger a...

Linux file chooser crashes on malformed images due to flaws in Jasper library — Mozilla

Security researcher Gustavo Grieco reported that on Linux Gnome systems the dialog for choosing local files uses the operating system's gdk-pixbuf library to render thumbnails for image file types. This library supports various image decoders, and Grieco reported that the Jasper and TGA decoders...

The vulnerability of the QEMU hardware emulation software, which allows a hacker to trigger a service failure

The vulnerability in the hw/virtio/virtio.c module of the QEMU virtualized hardware device support mechanism is caused by buffer overflow. Exploiting this vulnerability allows an attacker to cause a service failure by sending large amounts of data to the tuntap or macvtap interfaces when the buff...

389 Directory Server nsSSL3Ciphers Preference Vulnerability

389 Directory Server is an LDAP server developed by Red Hat. A preference vulnerability exists in 389 Directory Server nsSSL3Ciphers, which could allow a remote attacker to perform a security attack by requesting the use of a disabled cipherset...

Design/Logic Flaw

389 Directory Server formerly Fedora Directory Server before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher...

UBUNTU-CVE-2015-3230

389 Directory Server formerly Fedora Directory Server before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher...

CVE-2015-3230

389 Directory Server formerly Fedora Directory Server before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher...

DEBIAN-CVE-2015-3230

389 Directory Server formerly Fedora Directory Server before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher...

Desktop Viewer is Showing Up Even though it has been Disabled Through the web.config File

Desktop Viewer is showing up even though it has been disabled through the web.config file...

Microsoft Office 2007 - BIFFRecord Length Use-After-Free

Microsoft Office 2007 - BIFFRecord Length Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=464 The following crash was observed in Microsoft Office 2007 with Microsoft Office File Validation Add-In disabled and Application Verifier enabled for testing and...

Linux MD Driver Initialization Memory Disclosure Vulnerability

Linux kernel is an open source operating system. A security vulnerability exists in Linux kernel, which can be exploited by a local attacker to obtain 4095 bytes of information in kernel memory when a bitmap file requests a device via getbitmapfile but bitmap is disabled and the system fails to...

Debian DSA-3315-1 : chromium-browser - security update

Several vulnerabilities were discovered in the chromium web browser. - CVE-2015-1266 Intended access restrictions could be bypassed for certain URLs like chrome://gpu. - CVE-2015-1267 A way to bypass the Same Origin Policy was discovered. - CVE-2015-1268 Mariusz Mlynski also discovered a way to...

CVE-2015-1936

The administrative console in IBM WebSphere Application Server WAS 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter...

Disabled Users Receive Notification from Team Calendar

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48834. panel h3. Summary Confluence disabled users that subscribed to a calendar still receive notifications when calendar have...

Disabled Users Receive Notification from Team Calendar

h3. Summary Confluence disabled users that subscribed to a calendar still receive notifications when calendar have new events added or when events in the subscribed calendar are modified. h3. Steps to Reproduce Create a new user in Confluence Make the new user watch a calendar in Team Calendar...

Disabled Users Receive Notification from Team Calendar

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-48834. panel h3. Summary Confluence disabled users that subscribed to a calendar still receive notifications when calendar have...

Disabled Users Receive Notification from Team Calendar

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48834. panel h3. Summary Confluence disabled users that subscribed to a calendar still receive notifications when calendar have...

Microsoft ASP.NET Information Disclosure (MS15-041) - ver 2 (CVE-2015-1648)

An information disclosure vulnerability exists in Microsoft .NET Framework. The vulnerability is due to improper requests sanitization on servers with error messages disabled. A remote attacker can exploit this vulnerability by sending specially crafted requests to the vulnerable server...

SUSE-SU-2015:1344-1 Security update for python

This update to python 2.7.9 fixes the following issues: python-2.7-libffi-aarch64.patch: Fix argument passing in libffi for aarch64 From the version update to 2.7.9: contains full backport of ssl module from Python 3.4 PEP466 HTTPS certificate validation enabled by default PEP476 SSLv3 disabled b...

async-http-client: SSL/TLS certificate verification is disabled under certain conditions

It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle MITM attacker could use this flaw to spoof a valid certificate...