USN-1443-1: Update Manager vulnerabilities

It was discovered that Update Manager created system state archive files with incorrect permissions when upgrading releases. A local user could possibly use this to read repository credentials. CVE-2012-0948 Felix Geyer discovered that the Update Manager Apport hook incorrectly uploaded certain...

CVE-2012-2319

Multiple buffer overflows in the hfsplus filesystem implementation in the Linux kernel before 3.3.5 allow local users to gain privileges via a crafted HFS plus filesystem, a related issue to CVE-2009-4020...

CVE-2012-0949

The Apport hook in Update Manager as used by Ubuntu 12.04 LTS, 11.10, and 11.04 uploads certain system state archive files when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report...

CVE-2012-2133

Use-after-free vulnerability in the Linux kernel before 3.3.6, when huge pages are enabled, allows local users to cause a denial of service system crash or possibly gain privileges by interacting with a hugetlbfs filesystem, as demonstrated by a umount operation that triggers improper handling of...

CVE-2012-2270

Open redirect vulnerability in index.php aka the Login Page in ownCloud before 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirecturl parameter...

CVE-2012-1572

OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space...

CVE-2012-1166

The default keybindings for wwm in LTSP Display Manager ldm 2.2.x before 2.2.7 allow remote attackers to execute arbitrary commands via the KPRETURN keybinding, which launches a terminal window...

CVE-2012-1502

Double free vulnerability in the PyPAMconv in PAMmodule.c in PyPam 0.5.0 and earlier allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a NULL byte in a password string...

CVE-2012-0867

PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters...

CVE-2012-0065

Heap-based buffer overflow in the receivepacket function in libusbmuxd/libusbmuxd.c in usbmuxd 1.0.5 through 1.0.7 allows physically proximate attackers to execute arbitrary code via a long SerialNumber field in a property list...

CVE-2011-4622

The createpittimer function in arch/x86/kvm/i8254.c in KVM 83, and possibly other versions, does not properly handle when Programmable Interval Timer PIT interrupt requests IRQs when a virtual interrupt controller irqchip is not available, which allows local users to cause a denial of service NUL...

CVE-2012-0056

The memwrite function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc//mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper...

PHPBridges Blog System - members.php SQL Injection

PHPBridges Blog System - members.php SQL Injection Exploit Title: PhpBridges Blog System SQL Injection Vulnerability Date: 18/01/2012 - 04.19 Author: 3spi0n Software Website: https://launchpad.net/phpbridges Tested On: BackTrack 5 - Win7 Ultimate Platform: Php $ Vulnerable File: members.php $ Dem...

PhpBridges Blog System members.php SQL Injection

Exploit for php platform in category web applications Exploit Title: PhpBridges Blog System SQL Injection Vulnerability Date: 18/01/2012 - 04.19 Author: 3spi0n Software Website: https://launchpad.net/phpbridges Tested On: BackTrack 5 - Win7 Ultimate Platform: Php $ Vulnerable File: members.php $...

PHPBridges Blog System - 'members.php' SQL Injection

Exploit Title: PhpBridges Blog System SQL Injection Vulnerability Date: 18/01/2012 - 04.19 Author: 3spi0n Software Website: https://launchpad.net/phpbridges Tested On: BackTrack 5 - Win7 Ultimate Platform: Php $ Vulnerable File: members.php $ Demo Sites: server/members.php?id=2" SQL Injection Dar...

PhpBridges Blog System SQL Injection

Exploit Title: PhpBridges Blog System SQL Injection Vulnerability Date: 18/01/2012 - 04.19 Author: 3spi0n Software Website: https://launchpad.net/phpbridges Tested On: BackTrack 5 - Win7 Ultimate Platform: Php $ Vulnerable File: members.php $ Demo Sites: fantasticas.odisseias.net/members.php?id=2...

CVE-2010-4648

The orinocoioctlsetauth function in drivers/net/wireless/orinoco/wext.c in the Linux kernel before 2.6.37 does not properly implement a TKIP protection mechanism, which makes it easier for remote attackers to obtain access to a Wi-Fi network by reading Wi-Fi frames...

CVE-2011-4621

The Linux kernel before 2.6.37 does not properly implement a certain clock-update optimization, which allows local users to cause a denial of service system hang via an application that executes code in a loop...

CVE-2011-4824

SQL injection vulnerability in authlogin.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the loginusername parameter...

[USN-1289-1] colord vulnerability

========================================================================== Ubuntu Security Notice USN-1289-1 December 07, 2011 colord vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...