Updated privoxy package fixes security vulnerabilities

Updated privoxy packages fix security issues: A memory leak occurred in privoxy 3.0.21 compiled with IPv6 support when rejecting client connections due to the socket limit being reached. CID 66382 A use-after-free bug was found in privoxy 3.0.21 and two additional potential use-after-free issues...

CVE-2014-9401

CVE-2014-9401 affects the WordPress plugin “WP Limit Posts Automatically” (versions

PT-2014-8992

Name of the Vulnerable Software and Affected Versions WP Limit Posts Automatically plugin version 0.7 and earlier Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks...

CVE-2014-9401: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the lpapostletters parameter in the...

OracleVM 3.3 : bind (OVMSA-2014-0084)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2014-8500 1171973 - Use /dev/urandom when generating rndc.key file 951255 - Remove bogus file from /usr/share/doc, introduced by fix for bug 1092035 - Add support for TLSA resource records...

齐博地方门户系统sql注入

简要描述： 变量未初始化导致注入 详细说明： 齐博地方门户系统 齐博的全局过滤系统中由于存在如下代码，导致传入的参数可以成为全局变量 foreach$COOKIE AS $key=$value unset$$key; foreach$POST AS $key=$value !ereg"^\A-Z+",$key && $$key=$POST$key; foreach$GET AS $key=$value !ereg"^\A-Z+",$key && $$key=$GET$key; 所以系统中如果存在未初始化的变量，容易导致注入 2shou/post.php中 180行...

WordPress WP Limit Posts Automatically 0.7 CSRF / XSS

Title: CSRF / Stored XSS Vulnerability in WP Limit Posts Automatically Wordpress Plugin Author: Manideep K cve-id: CVE-2014-9401 Plugin Homepage: https://wordpress.org/plugins/wp-limit-posts-automatically/ Version Affected: 0.7 probably lower versions Severity: High Description: Vulnerable...

CVE-2014-8117

CVE-2014-8117 affects the file utility; the softmagic.c code path in file before 5.21 does not properly limit recursion, enabling a remote attacker to trigger a denial of service (CPU consumption or crash) via unspecified vectors. Connected advisories confirm this issue alongside CVE-2014-8116 an...

Fedora 20 : curl-7.32.0-17.fc20 (2014-16538)

make CURLOPTLOWSPEEDLIMIT work again with threaded resolver 1172572 - allow to use TLS 1.1 and TLS 1.2 1153814 - disable libcurl-level downgrade to SSLv3 1166567 - low-speed-limit: avoid timeout flood 1166239 - fix handling of CURLOPTCOPYPOSTFIELDS in curleasyduphandle CVE-2014-3707 Note that...

FreeBSD : bind -- denial of service vulnerability (ab3e98d9-8175-11e4-907d-d050992ecde8)

ISC reports : We have today posted updated versions of 9.9.6 and 9.10.1 to address a significant security vulnerability in DNS resolution. The flaw was discovered by Florian Maury of ANSSI, and applies to any recursive resolver that does not support a limit on the number of recursions...

[oss-security] PowerDNS Security Advisory 2014-02

Hi everybody, Please be aware of PowerDNS Security Advisory 2014-02 http://doc.powerdns.com/md/security/powerdns-advisory-2014-02/, which you can also find below. The good news is that the currently released version of the PowerDNS Recursor is safe. The bad news is that users of older versions wi...

SOL15880 - Libpng vulnerability CVE-2008-6218

Recommended action ARX If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists. To mitigate th...

OracleVM 3.1 : xen (OVMSA-2012-0046)

The remote OracleVM system is missing necessary patches to address critical security updates : - Xen Security Advisory CVE-2012-4411 / XSA-19 version 2 guest administrator can access qemu monitor console Disable qemu monitor by default. The qemu monitor is an overly powerful feature which must be...

SOL15862 - Multiple cURL and libcurl vulnerabilities CVE-2014-0015, CVE-2014-0138, and CVE-2014-0139

Recommended Action BIG-IP, BIG-IQ, and Enterprise Manager If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candida...

CVE-2014-4451

Apple iOS before 8.1.1 does not properly enforce the failed-passcode limit, which makes it easier for physically proximate attackers to bypass the lock-screen protection mechanism via a series of guesses...

Amazon Linux AMI : ruby21 (ALAS-2014-449)

The upstream patch for CVE-2014-8080 introduced checks against the REXML.entityexpansiontextlimit, but did not add restrictions to limit the number of expansions performed, i.e. checks against the REXML::Document.entityexpansionlimit. As a consequence, even with the patch applied, a small XML...

PT-2014-5913

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1.1 Description The issue concerns the lock-screen protection mechanism, where the failed-passcode limit is not properly enforced. This makes it easier for physically proximate attackers to bypass the lock screen...

CVE-2014-4451: Undefined Security Weakness

Apple iOS before 8.1.1 does not properly enforce the failed-passcode limit, which makes it easier for physically proximate attackers to bypass the lock-screen protection mechanism via a series of guesses...

Monstra 3.0.1 Bruteforce Mitigation Bypass

Monstra = 5 $loginerror = 'You are banned for 10 minutes. Try again later', 'users'; else $user = $users-select"login='" . trimRequest::post'login' . "'", null; The code blocks bruteforce attempts simply by placing a cookie called "loginattempts" in the victims browser an attacker can craft a...

DEBIAN-CVE-2014-8549

libavcodec/on2avc.c in FFmpeg before 2.4.2 does not constrain the number of channels to at most 2, which allows remote attackers to cause a denial of service out-of-bounds access or possibly have unspecified other impact via crafted On2 data...