GNU C library dynamic linker LD_AUDIT arbitrary DSO load Vulnerability

No description provided by source. from: http://marc.info/?l=full-disclosure&m=128776663124692&w=2 The GNU C library dynamic linker will dlopen arbitrary DSOs during setuid loads ------------------------------------------------------------------------------- Cześć, This advisory describes...

Progress Database 9.1 Environment Variable Local Privilege Escalation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7916/info It has been reported that Progress database does not properly handle untrusted input when opening shared libraries. Specifically, the dlopen function used by several Progress utilities checks the user's PATH...

CrystalPlayer 1.98 - (.mls) Local Buffer Overflow Exploit

No description provided by source. !/usr/bin/perl Crystal Player 1.98 Playlist.mls File Local Buffer Overflow Exploit Source:: http://www.crystalplayer.com/CrystalPro.exe Credit To Timq For The Vulnerability POC By Arham Muhammad While Debugging EIP And EBP Successfully Gets Overwritten! Upon...

GLSA-201406-34 : KDE Libraries: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201406-34 KDE Libraries: Multiple vulnerabilities Multiple vulnerabilities have been discovered in KDE Libraries. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could cause a...

KDE Libraries: Multiple vulnerabilities

Background KDE is a feature-rich graphical desktop environment for Linux and Unix-like operating systems. KDE Libraries contains libraries needed by all KDE applications. Description Multiple vulnerabilities have been discovered in KDE Libraries. Please review the CVE identifiers referenced below...

DLA-0009-1 lxml - security update

Bulletin has no description...

OpenSSL Heartbleed Patch Progress Slowing Two Months Later

It’s been more than two months since news broke of the Heartbleed vulnerability in OpenSSL one of the Internet’s most widely deployed cryptographic libraries. In the days and weeks that followed the emergence of the bug, which affected an unknown but arguably vast swath of the Web, vendors were...

SuSE 11.3 Security Update : openssh (SAT Patch Number 9357)

This update for OpenSSH fixes the following issues : - Exit sshd normally when port is already in use. bnc832628 - Use hardware crypto engines where available. bnc826427 - Use correct options for login when it is used. bnc833605 - Move FIPS messages to higher debug level. bnc862875 - Fix forwardi...

IBM DB2 10.1 < Fix Pack 3a Multiple Vulnerabilities

According to its version, the installation of IBM DB2 10.1 running on the remote host is prior to Fix Pack 3a. It is, therefore, affected by one or more of the following vulnerabilities : - The included version of GSKit contains an error related to CBC-mode and timing that could allow an attacker...

unexpected pitfall in xenaccess API

ISSUE DESCRIPTION A test/example program, for exercising the Xen memaccess API, does not take all necessary precautions against hostile guest behaviour. As a result, software developers using it as an example or template might have written and deployed vulnerable code. See the patch for technical...

IBM DB2 privilege escalation

Insecure dynamic libraries loading...

openSUSE Security Update : nss-201112 (openSUSE-SU-2012:0030-1) (BEAST)

The Mozilla NSS libraries were updated to version 3.13.1 to fix various bugs and security problems. Following security issues were fixed : - SSL 2.0 is disabled by default - A defense against the SSL 3.0 and TLS 1.0 CBC chosen plaintext attack demonstrated by Rizzo and Duong CVE-2011-3389 is...

openSUSE Security Update : phpMyAdmin (openSUSE-2012-135)

update to 3.4.10.1 fix for bnc747841 - security XSS in replication setup, see PMASA-2012-1 - 3.4.10.0 2012-02-14 - bug 3460090 interface TextareaAutoSelect feature broken - patch 3375984 export PHP Array export might generate invalid php code - bug 3049209 import Import from ODS ignores cell that...

openSUSE Security Update : libfreebl3 (openSUSE-SU-2011:0935-1)

The mozilla NSS libraries were updated to 3.12.11 to align with newer Mozilla seamonkey and Firefox releases. Interesting changes are : - blacklisting malicious root certificates - several bugfixes %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

openSUSE Security Update : glibc (openSUSE-SU-2010:0912-1)

This update of glibc fixes two bugs and security issues : CVE-2010-3847: Decoding of the $ORIGIN special value in various LD environment variables allowed local attackers to execute code in context of e.g. setuid root programs, elevating privileges. This issue does not affect SUSE as an assertion...

OpenJDK: ServiceLoader Exception handling security bypass (Libraries, 8031394)

Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries...

OpenJDK: Protect logger handlers (Libraries, 8029740)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries...

OpenJDK: ServiceLoader Exception handling security bypass (Libraries, 8031394)

Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries...

[SECURITY] Fedora 20 Update: mingw-icu-50.1.2-3.fc20

ICU is a set of C and C++ libraries that provides robust and full-featured Unicode and locale support. The library provides calendar support, conversions for many character sets, language sensitive collation, date and time formatting, support for many locales, message catalogs and resources,...

IBM WebSphere MQ 7.1 < 7.1.0.5 / 7.5 < 7.5.0.3 Multiple Vulnerabilities

The version of IBM WebSphere MQ server 7.1 / 7.5 installed on the remote Windows host is missing fix pack 7.1.0.5 / 7.5.0.3 or later. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists due to a failure to sanitize user-supplied input in...