Debian DSA-3255-1 : zeromq3 - security update

It was discovered that libzmq, a lightweight messaging kernel, is susceptible to a protocol downgrade attack on sockets using the ZMTP v3 protocol. This could allow remote attackers to bypass ZMTP v3 security mechanisms by sending ZMTP v2 or earlier headers. %NASLMINLEVEL 70300 C Tenable Network...

Debian Security Advisory DSA 3255-1 (zeromq3 - security update)

It was discovered that libzmq, a lightweight messaging kernel, is susceptible to a protocol downgrade attack on sockets using the ZMTP v3 protocol. This could allow remote attackers to bypass ZMTP v3 security mechanisms by sending ZMTP v2 or earlier headers. OpenVAS Vulnerability Test $Id:...

[SECURITY] Fedora 22 Update: jnr-posix-3.0.9-3.fc22

jnr-posix is a lightweight cross-platform POSIX emulation layer for Java, written in Java and is part of the JNR project...

[SECURITY] [DLA 203-1] openldap security update

Package : openldap Version : 2.4.23-7.3+deb6u1 CVE IDs : CVE-2012-1164 CVE-2013-4449 CVE-2014-9713 CVE-2015-1545 Debian Bugs : 663644 729367 761406 776988 Multiple vulnerabilities were found in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. Please carefully check...

[SECURITY] Fedora 21 Update: openldap-2.4.40-3.fc21

OpenLDAP is an open source suite of LDAP Lightweight Directory Access Protocol applications and development tools. LDAP is a set of protocols for accessing directory services usually phone book style information, but other information is possible over the Internet, similar to the way DNS Domain...

Security update for MozillaFirefox, MozillaThunderbird, mozilla-nspr (important)

Mozilla Firefox and Thunderbird were updated to fix several important vulnerabilities. Mozilla Firefox was updated to 37.0.1. Mozilla Thunderbird was updated to 31.6.0. mozilla-nspr was updated to 4.10.8 as a dependency. The following vulnerabilities were fixed in Mozilla Firefox: Miscellaneous...

Mozilla Firefox Multiple Vulnerabilities-01 (Apr 2015) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Mozilla Firefox lightweight theme installation allows bypass vulnerability

Mozilla Firefox is a web browser released by Mozilla. A security vulnerability exists in Mozilla Firefox that allows a man-in-the-middle attacker to spoof Moziall subdomains to bypass user consent information to install Firefox lightweight themes...

CVE-2015-0812

Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdoma...

CVE-2015-0812

CVE-2015-0812 affects Mozilla Firefox prior to 37.0, where lightweight theme add-on installations could be initiated over HTTP, allowing a man-in-the-middle to bypass the user-confirmation gate by DNS-spoofing a mozilla.org subdomain. The vulnerability enables MITM-style deployment of themes with...

CVE-2015-0812

Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdoma...

FreeBSD : mozilla -- multiple vulnerabilities (d0c97697-df2c-4b8b-bff2-cec24dc35af8)

The Mozilla Project reports : MFSA-2015-30 Miscellaneous memory safety hazards rv:37.0 / rv:31.6 MFSA-2015-31 Use-after-free when using the Fluendo MP3 GStreamer plugin MFSA-2015-32 Add-on lightweight theme installation approval bypassed through MITM attack MFSA-2015-33 resource:// documents can...

UBUNTU-CVE-2015-0812

Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdoma...

KLA10525 Multiple vulnerabilities in Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird

Multiple serious vulnerabilities have been found in Mozilla Firefox before 37.0, Mozilla Firefox ESR 31.x before 31.6, Mozilla Thunderbird before 31.6. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause a denial of service heap memory corruption and bypass an...

Add-on lightweight theme installation approval bypassed through MITM attack — Mozilla

Security researcher Armin Ebert discovered that a man-in-the-middle MITM attacker spoofing a Mozilla sub-domain could bypass user approval messages to install a Firefox lightweight theme. This was possible because add-on installations of the lightweight themes do not require the use of HTTP over...

[SECURITY] [DSA 3209-1] openldap security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3209-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez March 30, 2015 http://www.debian.org/security/faq -...

DSA-3209-1 openldap - security update

Bulletin has no description...

[SECURITY] Fedora 20 Update: freexl-1.0.0i-1.fc20

FreeXL is a library to extract valid data from within an Excel spreadsheet .xls Design goals: simple and lightweight stable, robust and efficient easily and universally portable completely ignore any GUI-related oddity...

GeniXCMS 0.0.1 - Multiple Vulnerabilities

GeniXCMS 0.0.1 - Multiple Vulnerabilities GeniXCMS v0.0.1 Remote Unauthenticated SQL Injection Exploit Vendor: MetalGenix Product web page: http://www.genixcms.org Affected version: 0.0.1 Summary: GenixCMS is a PHP Based Content Management System and Framework CMSF. It's a simple and lightweight...

RHEL 7 : 389-ds-base (RHSA-2015:0416)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0416 advisory. The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and...