Analyzing ASLR in Android Ice Cream Sandwich 4.0

When I first saw the release notes for the new Android Ice Cream Sandwich ICS platform, I was excited to see that Google mentioned that “Android 4.0 now provides address space layout randomization”. For the uninitiated, ASLR randomizes where various areas of memory eg. stack, heap, libs, etc are...

mysql security update

CentOS Errata and Security Advisory CESA-2012:0105 Updated mysql packages that fix several security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base...

Medium: krb5

Issue Overview: Multiple NULL pointer dereference and assertion failure flaws were found in the MIT Kerberos KDC when it was configured to use an LDAP Lightweight Directory Access Protocol or Berkeley Database Berkeley DB back end. A remote attacker could use these flaws to crash the KDC...

Ubuntu 10.04 LTS / 10.10 / 11.04 : kde4libs vulnerability (USN-1248-1)

Tim Brown discovered that KSSL in KDE-Libs did not properly perform input validation when displaying the common name CN for an SSL certificate. An attacker could exploit this to spoof the common name which could be used in an attack to trick the user into accepting a fraudulent certificate. This...

USN-1248-1: KDE-Libs vulnerability

Tim Brown discovered that KSSL in KDE-Libs did not properly perform input validation when displaying the common name CN for an SSL certificate. An attacker could exploit this to spoof the common name which could be used in an attack to trick the user into accepting a fraudulent certificate. This...

Fedora 16 : firefox-7.0-1.fc16 / mozvoikko-1.9.0-8.fc16 / xulrunner-7.0-1.fc16 (2011-13422)

Update to new upstream Firefox version 7.0, fixing multiple security issues detailed in the upstream advisories : - http://www.mozilla.org/security/known-vulnerabilities/fi refox.htmlfirefox7 This update also includes all packages depending on gecko-libs rebuilt against the new version of Firefox...

Fedora 14 : firefox-3.6.23-1.fc14 / galeon-2.0.7-44.fc14.1 / gnome-python2-extras-2.25.3-34.fc14.1 / etc (2011-13467)

Update to new upstream Firefox version 3.6.23, fixing multiple security issues detailed in the upstream advisories : - http://www.mozilla.org/security/known-vulnerabilities/fi refox36.htmlfirefox3.6.23 This update also includes all packages depending on gecko-libs rebuilt against the new version ...

Information disclosure

BIGACE 2.7.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/libs/javascript.inc.php and certain other files...

CVE-2011-3758

::mound:: 2.1.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/smarty/libs/sysplugins/smartyinternaltemplate.php and certain other files...

Fedora 16 : firefox-6.0-1.fc16 / mozvoikko-1.9.0-6.fc16 / thunderbird-6.0-1.fc16 / etc (2011-11046)

Update to new upstream Firefox version 6.0 and Thunderbird version 6.0, fixing multiple security issues detailed in the upstream advisories : - http://www.mozilla.org/security/announce/2011/mfsa2011-2 9.html - http://www.mozilla.org/security/announce/2011/mfsa2011 -31.html This update also includ...

Fedora 14 : firefox-3.6.20-1.fc14 / galeon-2.0.7-42.fc14.1 / gnome-python2-extras-2.25.3-32.fc14.1 / etc (2011-11084)

Update to new upstream Firefox version 3.6.20 and Thunderbird version 3.1.12, fixing multiple security issues detailed in the upstream advisories : - http://www.mozilla.org/security/announce/2011/mfsa2011-3 0.html - http://www.mozilla.org/security/announce/2011/mfsa2011 -32.html This update also...

Fedora 15 : firefox-6.0-1.fc15 / gnome-python2-extras-2.25.3-33.fc15 / mozvoikko-1.9.0-6.fc15 / etc (2011-11106)

Update to new upstream Firefox version 6.0, fixing multiple security issues detailed in the upstream advisory : - http://www.mozilla.org/security/announce/2011/mfsa2011-2 9.html This update also includes all packages depending on gecko-libs rebuilt against the new version of Firefox / XULRunner...

Fedora 14 : firefox-3.6.18-1.fc14 / galeon-2.0.7-41.fc14.1 / gnome-python2-extras-2.25.3-31.fc14.1 / etc (2011-8647)

Update to new upstream Firefox version 3.6.18 and Thunderbird version 3.1.11, fixing multiple security issues detailed in the upstream advisories : - http://www.mozilla.org/security/known-vulnerabilities/fi refox36.htmlfirefox3.6.18 - http://www.mozilla.org/security/known-vulnerabilities/...

Fedora 15 : firefox-5.0-1.fc15 / gjs-0.7.14-6.fc15 / gnome-python2-extras-2.25.3-32.fc15 / etc (2011-8627)

Update to new upstream Firefox version 5.0, fixing multiple security issues detailed in the upstream advisories : - http://www.mozilla.org/security/known-vulnerabilities/fi refox.htmlfirefox5 See upstream release notes for more information about this new version : -...

Fedora 13 : firefox-3.6.17-1.fc13 / galeon-2.0.7-40.fc13 / gnome-python2-extras-2.25.3-29.fc13 / etc (2011-6205)

Update to new upstream Firefox version 3.6.17, fixing multiple security issues detailed in the upstream advisories : http://www.mozilla.org/security/known-vulnerabilities/firefox36.htmlf irefox3.6.17 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox ...

Fedora 14 : firefox-3.6.17-1.fc14 / galeon-2.0.7-40.fc14.1 / gnome-python2-extras-2.25.3-30.fc14.1 / etc (2011-6215)

Update to new upstream Firefox version 3.6.17, fixing multiple security issues detailed in the upstream advisories : http://www.mozilla.org/security/known-vulnerabilities/firefox36.htmlf irefox3.6.17 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox ...

USN-1110-1: KDE-Libs vulnerabilities

It was discovered that KDE KSSL did not properly verify X.509 certificates when the certificate was issued for an IP address. An attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications. CVE-2011-1094 Tim Brown discovere...

Gentoo Security Advisory GLSA 201011-01 (glibc)

The remote host is missing updates announced in advisory GLSA 201011-01. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 201101-03 (libvpx)

The remote host is missing updates announced in advisory GLSA 201101-03. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

Gentoo Security Advisory GLSA 201009-01 (wxGTK)

The remote host is missing updates announced in advisory GLSA 201009-01. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...