MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries

Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attack method called MavenGate. "Access to projects can be hijacked through domain name purchases and since most default build configurations a...

Debian DSA-3514-1 : samba - security update

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2015-7560 Jeremy Allison of Google, Inc. and the Samba Team discovered that Samba incorrectly handles...

CVE-2016-0771

The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service out-of-bounds read or possibly obtain sensitive information from process memory by...

Out-of-bounds

The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service out-of-bounds read or possibly obtain sensitive information from process memory by...

SUSE SLES11 Security Update : PHP5 (SUSE-SU-2014:0868-1)

PHP5 has been updated to fix two security vulnerabilities : - Heap-based buffer overflow in DNS TXT record parsing CVE-2014-4049 - NULL pointer dereference in GD XPM decoder CVE-2014-2497 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

[SECURITY] [DLA 67-1] php5 security update

Package : php5 Version : 5.3.3-7+squeeze22 CVE ID : CVE-2014-3538 CVE-2014-3587 CVE-2014-3597 CVE-2014-3538 It was discovered that the original fix for CVE-2013-7345 did not sufficiently address the problem. A remote attacker could still cause a denial of service CPU consumption via a...

Debian DSA-3008-1 : php5 - security update

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2014-3538 It was discovered that the original fix for CVE-2013-7345 did not...

Debian Security Advisory DSA 3008-1 (php5 - security update)

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2014-3538It was discovered that the original fix for CVE-2013-7345 did not...

DSA-3008-1 php5 - security update

Bulletin has no description...

Oracle Linux 5 / 6 : php53 / and / php (ELSA-2014-1012)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1012 advisory. - core: type confusion issue in phpinfo. CVE-2014-4721 - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712 - core: fix heap-base...

php53 and php security update

5.3.3-27.1 - core: type confusion issue in phpinfo. CVE-2014-4721 - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712 - core: fix heap-based buffer overflow in DNS TXT record parsing. CVE-2014-4049 - core: unserialize SPL ArrayObject / SPLObjectStorage type confusion flaw...

Updated php packages fix multiple vulnerabilities

Updated php packages fix security vulnerabilities: The unserialize function in PHP before 5.4.30 and 5.5.14 has a Type Confusion issue related to the SPL ArrayObject and SPLObjectStorage Types CVE-2014-3515. It was discovered that PHP is vulnerable to a heap-based buffer overflow in the DNS TXT...

Updated php packages fix multiple vulnerabilities

Updated php packages fix security vulnerabilities: The unserialize function in PHP before 5.4.30 and 5.5.14 has a Type Confusion issue related to the SPL ArrayObject and SPLObjectStorage Types CVE-2014-3515. It was discovered that PHP is vulnerable to a heap-based buffer overflow in the DNS TXT...

LibSPF2 < 1.2.8 DNS TXT Record Parsing Bug Heap Overflow PoC

No description provided by source. Advisory: DNS TXT Record Parsing Bug in LibSPF2 Author: Dan Kaminsky, Director of Penetration Testing, IOActive Inc, [email protected] PGP Key In Appendix Abstract: A relatively common bug parsing TXT records delivered over DNS, dating at least back to...

php5 security update

Package : php5 Version : 5.3.3-7+squeeze20 CVE ID : CVE-2014-4049 It was discovered that PHP, a general-purpose scripting language commonly used for web application development, is vulnerable to a heap-based buffer overflow in the DNS TXT record parsing. A malicious server or man-in-the-middle...

php5 security update

Package : php5 Version : 5.3.3-7+squeeze20 CVE ID : CVE-2014-4049 It was discovered that PHP, a general-purpose scripting language commonly used for web application development, is vulnerable to a heap-based buffer overflow in the DNS TXT record parsing. A malicious server or man-in-the-middle...

DLA-0010-1 php5 - security update

Bulletin has no description...

CVE-2014-4049

Heap-based buffer overflow in the phpparserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service crash and possibly execute arbitrary code via a crafted DNS TXT record, related to the dnsgetrecord function...

CVE-2014-4049

Heap-based buffer overflow in the phpparserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service crash and possibly execute arbitrary code via a crafted DNS TXT record, related to the dnsgetrecord function...

[SECURITY] [DSA 2961-1] php5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2961-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso June 16, 2014 http://www.debian.org/security/faq -...