Security update for ruby2.1 (important)

This ruby2.1 update to version 2.1.9 fixes the following issues: Security issues fixed: - CVE-2016-2339: heap overflow vulnerability in the Fiddle::Function.new"initialize" bsc1018808 - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL bsc959495 - CVE-2015-3900: hostname validation does...

libevent: Out-of-bounds read in search_make_new()

An out of bounds read vulnerability was found in libevent in the searchmakenew function. If an attacker could cause an application using libevent to attempt resolving an empty hostname, an out of bounds read could occur possibly leading to a crash...

UBUNTU-CVE-2017-7938

Stack-based buffer overflow in DMitry Deepmagic Information Gathering Tool version 1.3a Unix allows attackers to cause a denial of service application crash or possibly have unspecified other impact via a long argument. An example threat model is automated execution of DMitry with hostname string...

libevent: Out-of-bounds read in search_make_new()

An out of bounds read vulnerability was found in libevent in the searchmakenew function. If an attacker could cause an application using libevent to attempt resolving an empty hostname, an out of bounds read could occur possibly leading to a crash...

SUSE-SU-2017:1067-1 Security update for ruby2.1

This ruby2.1 update to version 2.1.9 fixes the following issues: Security issues fixed: - CVE-2016-2339: heap overflow vulnerability in the Fiddle::Function.new'initialize' bsc1018808 - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL bsc959495 - CVE-2015-3900: hostname validation does...

CVE-2017-7938

Stack-based buffer overflow in DMitry Deepmagic Information Gathering Tool version 1.3a Unix allows attackers to cause a denial of service application crash or possibly have unspecified other impact via a long argument. An example threat model is automated execution of DMitry with hostname string...

VPN Server Hostname Detection via PPTP

Binary data 7268.pasl...

Dmitry 1.3a - Local Buffer Overflow (PoC)

Dmitry 1.3a - Local Buffer Overflow PoC Exploit Title: DmitryDeepmagic Information Gathering Tool Local Stack Buffer Overflow CVE: CVE-2017-7938 CWE: CWE-119 Exploit Author: Hosein Askari FarazPajohan Vendor HomePage: http://mor-pah.net/software/dmitry-deepmagic-information-gathering-tool/ Versio...

Man-in-the-Middle (MitM)

kafka-clients is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists because it uses InetAddress.getHostName to perform hostname verification by using the hostname obtained through a reverse DNS lookup. Therefore, the authentication relies on the secure DNS. The attack is only...

CVE-2015-7826

Botan 1.11.x before 1.11.22 has a wildcard hostname matching flaw in X.509 verification, which may allow remote attackers to cause unspecified impact (e.g., accepting *.example.com for bar.foo.example.com). Affected software is Botan library; root cause is improper wildcard handling in hostname c...

CVE-2015-7826

Removed by vendor...

SUSE SLES11 Security Update : ruby (SUSE-SU-2017:0948-1)

This update for ruby fixes the following issues: Secuirty issues fixed : - CVE-2015-1855: Ruby OpenSSL Hostname Verification bsc926974 - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL bsc959495 Bugfixes : - fix small mistake in the backport for bsc986630 Note that Tenable Network...

SUSE-SU-2017:0948-1 Security update for ruby

This update for ruby fixes the following issues: Secuirty issues fixed: - CVE-2015-1855: Ruby OpenSSL Hostname Verification bsc926974 - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL bsc959495 Bugfixes: - fix small mistake in the backport for bsc986630...

Updated wget packages fix security vulnerability

Wget up untill version 1.19.1 does not ensure control characters are not used in the hostname part of a url. This security update rejects control characters in host part of a url...

MGASA-2017-0104 Updated wget packages fix security vulnerability

Wget up untill version 1.19.1 does not ensure control characters are not used in the hostname part of a url. This security update rejects control characters in host part of a url...

jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name

It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

Trend Micro InterScan Web Security Virtual Appliance ConfigIPNetwork saveNetworkConfiguration hostname Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro InterScan Web Security Virtual Appliance. Authentication is required to exploit this vulnerability. The specific flaw exists within ConfigIPNetwork's saveNetworkConfiguration method. A...

OracleVM 3.3 / 3.4 : bash (OVMSA-2017-0050)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix signal handling in read builtin Resolves: 1421926 - CVE-2016-9401 - Fix crash when '-' is passed as second sign to popd Resolves: 1396383 - CVE-2016-7543 - Fix for arbitrary code execution via...

SolarWinds Log and Event Manager Local Elevation of Privilege Vulnerability

SolarWinds Log and Event Manager LEM, a.k.a. SIEM is a log and event manager from the U.S.-based SolarWinds that provides real-time log analysis, memory event correlation, and threat attack response. A local elevation of privilege vulnerability exists in SolarWinds Log and Event Manager versions...

CVE-2017-7272

PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead ...