CVE-2013-4299

CVE-2013-4299 – Linux kernel (up to 3.11.6) Root cause: Interpretation conflict in drivers/md/dm-snap-persistent.c within the Linux kernel up to version 3.11.6. Impact: Remote authenticated users can obtain sensitive information or modify data by issuing a crafted mapping to a snapshot block devi...

CVE-2013-4299

Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device...

Oracle Linux 5 / 6 : unbreakable enterprise kernel (ELSA-2013-2576)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-2576 advisory. 2.6.39-400.209.2 - dm snapshot: fix data corruption Mikulas Patocka Orabug: 17618492 CVE-2013-4299 Tenable has extracted the preceding description block...

Debian DSA-2774-1 : gnupg2 - several vulnerabilities

Two vulnerabilities were discovered in GnuPG 2, the GNU privacy guard, a free PGP replacement. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2013-4351 When a key or subkey had its 'key flags' subpacket set to all bits off, GnuPG currently would treat t...

CVE-2013-5151

Mobile Safari in Apple iOS before 7 does not prevent HTML interpretation of a document served with a text/plain content type, which allows remote attackers to conduct cross-site scripting XSS attacks by uploading a file...

CVE-2013-5151

Mobile Safari in Apple iOS before 7 does not prevent HTML interpretation of a document served with a text/plain content type, which allows remote attackers to conduct cross-site scripting XSS attacks by uploading a file...

CVE-2013-5151

CVE-2013-5151 affects Mobile Safari on iOS prior to 7. The issue arises when a document served with Content-Type: text/plain is treated as HTML, allowing remote attackers to trigger cross-site scripting by uploading a file. Apple’s vulnerability entry for Safari (CVE-2013-5151) notes the impact a...

FISC: No Phone Company Ever Challenged Metadata Collection Orders

A newly declassified opinion from the Foreign Intelligence Surveillance Court from this summer shows the court’s interpretation of the controversial Section 215 of the USA PATRIOT Act that’s used to justify the National Security Agency’s bulk telephone metadata collections, and reveals that none ...

Government to Release Hundreds of Documents Related to NSA Surveillance

In response to a lawsuit by the Electronic Frontier Foundation, the Department of Justice is preparing to release a trove of documents related to the government’s secret interpretation of Section 215 of the PATRIOT Act. The declassified documents will include previously secret opinions of the...

Debian DSA-2742-1 : php5 - interpretation conflict

It was discovered that PHP, a general-purpose scripting language commonly used for web application development, did not properly process embedded NUL characters in the subjectAltName extension of X.509 certificates. Depending on the application and with insufficient CA-level checks, this could be...

[SECURITY] [DSA 2742-1] php5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2742-1 [email protected] http://www.debian.org/security/ August 26, 2013 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package...

Debian DSA-2672-1 : kfreebsd-9 - interpretation conflict

Adam Nowacki discovered that the new FreeBSD NFS implementation processes a crafted READDIR request which instructs to operate a file system on a file node as if it were a directory node, leading to a kernel crash or potentially arbitrary code execution. The kfreebsd-8 kernel in the oldstable...

Debian DSA-2609-1 : rails - SQL query manipulation

An interpretation conflict can cause the Active Record component of Rails, a web framework for the Ruby programming language, to truncate queries in unexpected ways. This may allow attackers to elevate their privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

DSA-2609-1 rails - SQL query manipulation

Bulletin has no description...

[DNSwalk] Running on BackTrack 5 R3

Dnswalk is a DNS debugger. It performs zone transfers of specifieddomains, and checks the database in numerous ways for internalconsistency, as well as accuracy. dnswalk is not for the faint of heart. It should NOT be used without a firm knowledge of the DNS RFC's. The warnings and errors must be...

USN-1603-1: Ruby vulnerabilities

Shugo Maedo and Vit Ondruch discovered that Ruby incorrectly allowed untainted strings to be modified in protective safe levels. An attacker could use this flaw to bypass intended access restrictions. CVE-2012-4466, CVE-2012-4481...

Scientific Linux Security Update : bash on SL5.x i386/x86_64

Bash is the default shell for Scientific Linux. It was found that certain scripts bundled with the Bash documentation created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary fil...

FreeBSD : rubygem-activerecord -- multiple vulnerabilities (748aa89f-d529-11e1-82ab-001fd0af1a4c)

rubygem-activerecord -- multiple vulernabilities Due to the way Active Record interprets parameters in combination with the way that Rack parses query parameters, it is possible for an attacker to issue unexpected database queries with 'IS NULL' where clauses. This issue does not let an attacker...

rubygem-activerecord -- multiple vulnerabilities

rubygem-activerecord -- multiple vulernabilities Due to the way Active Record interprets parameters in combination with the way that Rack parses query parameters, it is possible for an attacker to issue unexpected database queries with "IS NULL" where clauses. This issue does not let an attacker...

CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Advisory Name: libraptor - XXE in RDF/XML File Interpretation Release Date: 2012-03-24 Applications: libraptor / librdf...