CVE-2011-4407

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle MITM attackers to spoof GPG keys for a package repository...

CVE-2011-4407: Improper Input Validation

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle MITM attackers to spoof GPG keys for a package repository...

[ MDVSA-2014:054 ] otrs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:054 http://www.mandriva.com/en/support/security/ Package : otrs Date : March 13, 2014 Affected: Business Server 1.0 Problem Description: Updated otrs package fixes security vulnerability: An attacker could...

CVE-2011-3152

DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade...

Directory traversal

DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade...

CVE-2011-3152

CVE-2011-3152 affects Ubuntu Update Manager before certain versions of DistUpgradeFetcherCore.py (before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5) on Ubuntu 8.04–11.10. The flaw is improper verificat...

[ MDVSA-2014:063 ] x2goserver

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:063 http://www.mandriva.com/en/support/security/ Package : x2goserver Date : March 17, 2014 Affected: Business Server 1.0 Problem Description: Updated x2goserver package fixes security vulnerability: A...

USN-2147-1: Mutt vulnerability

Beatrice Torracca and Evgeni Golov discovered a buffer overflow in mutt while expanding addresses when parsing email headers. An attacker could specially craft an email to cause mutt to crash, resulting in a denial of service, or possibly execute arbitrary code with the privileges of the user...

CVE-2013-6952

The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote attackers to spoof firmware updates and execute arbitrary code via crafted signed data...

Hardcoded credentials

The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote attackers to spoof firmware updates and execute arbitrary code via crafted signed data...

CVE-2013-6952

The CVE-2013-6952 issue affects Belkin WeMo Home Automation firmware prior to 3949, which contains a hardcoded GPG key that could allow remote attackers to sign a malicious firmware update and execute arbitrary code via crafted signed data. Impact described across sources indicates potential remo...

CVE-2013-6952

The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote attackers to spoof firmware updates and execute arbitrary code via crafted signed data...

[SECURITY] Fedora 19 Update: python-gnupg-0.3.6-1.fc19

GnuPG bindings for python. This uses the gpg command...

CVE-2013-6952: Undefined Security Weakness

The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote attackers to spoof firmware updates and execute arbitrary code via crafted signed data...

[ MDVSA-2014:035 ] libpng

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:035 http://www.mandriva.com/en/support/security/ Package : libpng Date : February 17, 2014 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated libpng and libpng12 packages fix...

RedHat Update for gnupg RHSA-2014:0016-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[ MDVSA-2013:275 ] krb5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:275 http://www.mandriva.com/en/support/security/ Package : krb5 Date : November 21, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated krb5 package fixes security...

CVE-2013-3704

The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a repository when multiple key blobs are used, which might allow remote attackers to trick users into believing that the repository was signed by a...

CVE-2013-3704

The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a repository when multiple key blobs are used, which might allow remote attackers to trick users into believing that the repository was signed by a...

CVE-2013-3704

CVE-2013-3704 affects the RPM GPG key import/handling in libzypp up to version 12.15.0. When multiple key blobs are used, the signature fingerprint presented to users could differ from the repository’s actual signing key, potentially enabling an attacker to mislead users into trusting a signed re...