Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

CVE-2014-1492

The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...

CVE-2014-0076

The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack...

Fedora 19 : jansson-2.6-1.fc19 (2014-3782)

Florian Weimer of the Red Hat Product Security Team found that the hashing implementation in Jansson, a library for encoding, decoding and manipulating JSON data, was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause an application using Jansson to use an...

Fedora 20 : jansson-2.6-1.fc20 (2014-3778)

Florian Weimer of the Red Hat Product Security Team found that the hashing implementation in Jansson, a library for encoding, decoding and manipulating JSON data, was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause an application using Jansson to use an...

Oracle Linux 6 : net-snmp (ELSA-2014-0321)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-0321 advisory. 1:5.5-49.0.1.el65.1 - snmptrapd: Fix crash due to access of freed memory John Haxby orabug 14404682 1:5.5-49.1 - added 'diskio' option to snmpd.conf, it's...

CVE-2014-0124

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...

net-snmp security and bug fix update

1:5.5-49.0.1.el65.1 - snmptrapd: Fix crash due to access of freed memory John Haxby orabug 14404682 1:5.5-49.1 - added 'diskio' option to snmpd.conf, it's possible to monitor only selected devices in diskIOTable 990674 - fixed CVE-2014-2284: denial of service flaw in Linux implementation of...

CVE-2014-0127

CVE-2014-0127 affects Moodle: the time-validation logic in mod/feedback/complete.php and mod/feedback/complete_guest.php allows remote authenticated users to bypass restrictions when starting a Feedback activity by selecting an unavailable time. Affected versions include Moodle through 2.3.11, 2....

SuSE 11.3 Security Update : icedtea-web (SAT Patch Number 8974)

The OpenJDK Java Plugin IcedTea Web was released to fix a temporary file access problem. Changes : - Dialogs center on screen before becoming visible. - Support for u45 new manifest attributes Application-Name. - Custom applet permission policies panel in itweb-settings control panel. - Plugin...

array index error in dtoa implementation of many products

Array index error in the 1 dtoa implementation in dtoa.c aka pdtoa.c and the 2 gdtoa aka new dtoa implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x...

oath-toolkit replay attack

Implementation bug leads to replay attack possibility...

RedHat Update for kernel RHSA-2014:0285-01

Check for the Version of kernel OpenVAS Vulnerability Test RedHat Update for kernel RHSA-2014:0285-01 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

CVE-2014-1702

Use-after-free vulnerability in the DatabaseThread::cleanupDatabaseThread function in modules/webdatabase/DatabaseThread.cpp in the web database implementation in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecifie...

CentOS 5 : kernel (CESA-2014:0285)

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...

Cisco Intelligent Automation for Cloud Cryptographic Implementation Issues

Issues in the cryptographic implementation of Cisco Intelligent Automation for Cloud Cisco IAC may allow an unauthenticated, remote attacker to recover cryptographic material used in all Cisco IAC installations. The issues are due to the inclusion of fixed cryptographic material in the product...

Debian Security Advisory DSA 2879-1 (libssh - security update)

It was discovered that libssh, a tiny C SSH library, did not reset the state of the PRNG after accepting a connection. A server mode application that forks itself to handle incoming connections could see its children sharing the same PRNG state, resulting in a cryptographic weakness and possibly...

Information disclosure

EMC Documentum TaskSpace TSP 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dmworld group and the dmsuperusersdynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by...

CVE-2013-6493

The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp...

Design/Logic Flaw

The certificate-import feature in the Certificate Authority Proxy Function CAPF CLI implementation in Cisco Unified Communications Manager Unified CM 10.01 and earlier allows local users to read or modify arbitrary files via a crafted command, aka Bug ID CSCum95461...