CXF: Large invalid content could cause temporary space to fill

It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of dis...

Fedora 21 : qemu-2.1.3-5.fc21 (2015-5482)

CVE-2015-1779 vnc: insufficient resource limiting in VNC websockets decoder bz 1205051, bz 1199572 - Qemu: PRDT overflow from guest to host bz 1204919, bz 1205322 - CVE-2014-8106: cirrus: insufficient blit region checks bz 1170612, bz 1169454 - Fix .vdi disk corruption bz 1199400 - Don't install...

CVE-2015-1415

The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile /boot/encryption.key, which allows local users to obtain sensitive key information by reading the file...

CVE-2015-1415

FreeBSD 10.x installations using the bsdinstall installer with full-disk encrypted ZFS store the GELI master key in /boot/encryption.key with permissions 0644, exposing the key to local users. Root cause: default keyfile permissions are too open (world-readable) instead of 0600. Impact: local att...

CVE-2015-1415

The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile /boot/encryption.key, which allows local users to obtain sensitive key information by reading the file...

Google Chrome < 41.0.2272.76 Multiple Vulnerabilities

Binary data 8684.pasl...

FreeBSD -- Insecure default GELI keyfile permissions

Problem Description: The default permission set by bsdinstall8 installer when configuring full disk encrypted ZFS is too open. Impact: A local attacker may be able to get a copy of the geli8 provider's keyfile which is located at a fixed location...

Debian DLA-158-1 : request-tracker3.8 security update

Multiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2014-9472 Christian Loos discovered a remote denial of service vulnerability, exploitable via th...

Mandriva Linux Security Advisory : qemu (MDVSA-2015:061)

Updated qemu packages fix multiple security vulnerabilities : Sibiao Luo discovered that QEMU incorrectly handled device hot-unplugging. A local user could possibly use this flaw to cause a denial of service CVE-2013-4377. Michael S. Tsirkin discovered that QEMU incorrectly handled vmxnet3 device...

CVE-2015-1062

MobileStorageMounter in Apple iOS before 8.2 and Apple TV before 7.1 does not delete invalid disk-image folders, which allows attackers to create folders in arbitrary filesystem locations via a crafted app...

CVE-2015-1062

MobileStorageMounter in Apple iOS before 8.2 and Apple TV before 7.1 does not delete invalid disk-image folders, which allows attackers to create folders in arbitrary filesystem locations via a crafted app...

CVE-2015-1062

CVE-2015-1062 affects MobileStorageMounter in iOS before 8.2 and Apple TV before 7.1, where invalid disk-image folders were not deleted due to an issue in the developer disk mounting logic. This allowed a crafted app to create folders in arbitrary filesystem locations. Apple released fixes in iOS...

Apple iOS Disk Mount Logic Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability exists in Apple iOS that allows applications to create folders in trusted locations by exploiting a disk mount logic vulnerability...

GNOME Shell security, bug fix, and enhancement update

clutter 1.14.4-12 - Include upstream patch to prevent a crash when hitting hardware limits Resolves: rhbz1115162 1.14.4-11 - Fix a typo in the Requires 1.14.4-10 - Add patch for quadbuffer stereo suppport Resolves: rhbz1108891 cogl 1.14.1-6 - Add patches for quadbuffer stereo suppport Resolves:...

How to Simulate Veeam Backup & Replication Disk I/O

Purpose This article provides examples of using common workload simulators diskspd and fio to simulate Veeam Backup & Replication disk I/O. Do Not Send Test Output Files to Veeam Support The write test output files testfile.dat do not contain diagnostic data. As such, please do not attach them to...

Request Tracker Remote Denial of Service Vulnerability

Best Practical Solutions Request Tracker RT is an enterprise-grade, open source issue tracking system from Best Practical Solutions in the United States. The system has Bug tracking , customer service , customized workflow and other features . A denial of service vulnerability exists in Best...

PuTTY < 0.64 Multiple Information Disclosure Vulnerabilities

The remote host has a version of PuTTY installed that is prior to 0.64. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to a failure to clear SSH-2 private key information from the memory during the saving or loading of key files to...

[SECURITY] Fedora 21 Update: glibc-2.20-8.fc21

The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important se...

[SECURITY] Fedora 20 Update: glibc-2.18-19.fc20

The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important se...

Change to Lollipop Encryption Policy May Not Have Much Effect, Experts Say

Google has made a subtle, but important, shift in the requirements for Android handset makers, saying now that OEMs manufacturing phones that will run Lollipop do not have to enable disk encryption by default. This is a major change from the company’s stated position from just a few months ago, b...