Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-2220-1)

Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged local user could exploit this flaw to obtain potentially sensitive information from kernel memory. CVE-2014-1738 Matthew Daley reported a flaw in the handling of ioctl commands by the floppy...

Ubuntu 12.04 LTS : linux vulnerabilities (USN-2221-1)

Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged local user could exploit this flaw to obtain potentially sensitive information from kernel memory. CVE-2014-1738 Matthew Daley reported a flaw in the handling of ioctl commands by the floppy...

Authorization

The FlashCopy Manager for VMware component in IBM Tivoli Storage FlashCopy Manager 3.1 through 4.1.0.1 does not properly check authorization for backup and restore operations, which allows local users to obtain sensitive VM data or cause a denial of service data overwrite or disk consumption via...

Authorization

The Data Protection for VMware component in IBM Tivoli Storage Manager for Virtual Environments TSMVE 6.3 through 7.1.0.2 does not properly check authorization for backup and restore operations, which allows local users to obtain sensitive VM data or cause a denial of service disk consumption via...

CVE-2013-6714

The CVE-2013-6714 issue affects IBM Tivoli Storage FlashCopy Manager for VMware (FlashCopy Manager for VMware) 3.1, 3.2 and 4.1, where the GUI does not properly enforce authorization for backup/restore operations. This can allow local users to access VM data or perform restores that overwrite pro...

USN-2221-1: Linux kernel vulnerabilities

Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged local user could exploit this flaw to obtain potentially sensitive information from kernel memory. CVE-2014-1738 Matthew Daley reported a flaw in the handling of ioctl commands by the floppy...

Android Outlook App Could Expose Emails, Attachments

There are two issues with the way Microsoft’s Outlook application encrypts content on older versions of Android that could expose users’ emails and email attachments. Paolo Soto, a researcher with the security firm Include Security, said his team initially dug up the vulnerabilities in November...

[SECURITY] Fedora 19 Update: srm-1.2.13-1.fc19

srm is a secure replacement for rm1. Unlike the standard rm, it overwrites the data in the target files before unlinkg them. This prevents command-line recovery of the data by examining the raw block device. It may also help frustrate physical examination of the disk, although it's unlikely that...

[oss-security] CVE-2014-0222 Qemu: qcow1: Validate L2 table size

Hello, 'CVE-2014-0222' has been assigned to this issue. Too large L2 table sizes cause unbounded allocations. Images actually created by qemu-img only have 512 byte or 4k L2 tables. To keep things consistent with cluster sizes, allow ranges between 512 bytes and 64k in fact, down to 1 entry = 8...

CVE-2011-4970

Multiple SQL injection vulnerabilities in LCG Disk Pool Manager DPM before 1.8.6, as used in EGI UDM, allow remote attackers to execute arbitrary SQL commands via the 1 rtoken variable in the dpmgetpendingreqbytoken, 2 dpmgetcprbyfullid, 3 dpmgetcprbysurl, 4 dpmgetcprbysurls, 5 dpmgetgfrbyfullid,...

Sql injection

Multiple SQL injection vulnerabilities in LCG Disk Pool Manager DPM before 1.8.6, as used in EGI UDM, allow remote attackers to execute arbitrary SQL commands via the 1 rtoken variable in the dpmgetpendingreqbytoken, 2 dpmgetcprbyfullid, 3 dpmgetcprbysurl, 4 dpmgetcprbysurls, 5 dpmgetgfrbyfullid,...

UBUNTU-CVE-2011-4970

Multiple SQL injection vulnerabilities in LCG Disk Pool Manager DPM before 1.8.6, as used in EGI UDM, allow remote attackers to execute arbitrary SQL commands via the 1 rtoken variable in the dpmgetpendingreqbytoken, 2 dpmgetcprbyfullid, 3 dpmgetcprbysurl, 4 dpmgetcprbysurls, 5 dpmgetgfrbyfullid,...

CVE-2011-4970

Multiple SQL injection vulnerabilities in LCG Disk Pool Manager DPM before 1.8.6, as used in EGI UDM, allow remote attackers to execute arbitrary SQL commands via the 1 rtoken variable in the dpmgetpendingreqbytoken, 2 dpmgetcprbyfullid, 3 dpmgetcprbysurl, 4 dpmgetcprbysurls, 5 dpmgetgfrbyfullid,...

CVE-2011-4970

Multiple SQL injection vulnerabilities affect LCG Disk Pool Manager (DPM) before 1.8.6, as used in EGI UDM. The issues enable remote attackers to execute arbitrary SQL commands via numerous parameters (e.g., dpm_get_pending_req_by_token, dpm_get_cpr_by_fullid, dpm_insert_cpr_entry, dpm_update_spc...

[SECURITY] Fedora 20 Update: openstack-glance-2013.2.3-3.fc20

OpenStack Image Service code-named Glance provides discovery, registratio n, and delivery services for virtual disk images. The Image Service API server provides a standard REST interface for querying information about virtual d isk images stored in a variety of back-end stores, including OpenSta...

PT-2014-2184

Name of the Vulnerable Software and Affected Versions LCG Disk Pool Manager DPM versions prior to 1.8.6 Description The issue allows remote attackers to execute arbitrary SQL commands via vulnerable variables in several functions. The affected variables include r token, surl, to surl, u token, an...

CVE-2011-4970: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in LCG Disk Pool Manager DPM before 1.8.6, as used in EGI UDM, allow remote attackers to execute arbitrary SQL commands via the 1 rtoken variable in the dpmgetpendingreqbytoken, 2 dpmgetcprbyfullid, 3 dpmgetcprbysurl, 4 dpmgetcprbysurls, 5 dpmgetgfrbyfullid,...

CVE-2014-0110

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service /tmp disk consumption via a large invalid SOAP message...

CVE-2014-0110

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service /tmp disk consumption via a large invalid SOAP message...

PT-2014-3481

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 2.6.14 Apache CXF versions 2.7.x prior to 2.7.11 Description The issue allows remote attackers to cause a denial of service, specifically /tmp disk consumption, by sending a large invalid SOAP message...