USN-3253-2 nagios3 regression

USN-3253-1 fixed vulnerabilities in Nagios. The update prevented log files from being displayed in the web interface. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Nagios incorrectly handled certain long strings. A remote...

DNSTracer Stack Buffer Overflow Vulnerability

DNSTracer is an application used to track the DNS resolution process. A stack buffer overflow vulnerability exists in DNSTracer 1.9 and earlier versions. An attacker can exploit this vulnerability to cause a denial of service application crash with a command line with long parameters...

UBUNTU-CVE-2017-9430

Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service application crash or possibly have unspecified other impact via a command line with a long name argument that is mishandled in a strcpy call for argv0. An example threat model is a web application...

The vulnerability of Novell GroupWise software for collaborative work allows a perpetrator to execute arbitrary code.

The vulnerability of Novell GroupWise software for collaborative work is due to a numerical overflow condition. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code using the long user name or password...

Friday Squid Blogging: Giant Squid Caught Off the Coast of Ireland

It's rare: Fishermen caught a 19-foot-long giant squid off the coast of Ireland on Monday, only the fifth to be seen there since 1673. Also the first in 22 years. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting...

DEBIAN-CVE-2017-9043

readelf.c in GNU Binutils 2017-04-12 has a "shift exponent too large for type unsigned long" issue, which might allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted ELF file...

UBUNTU-CVE-2017-9042

readelf.c in GNU Binutils 2017-04-12 has a "cannot be represented in type long" issue, which might allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted ELF file...

BSA-2017-307

Security Advisory ID : BSA-2017-307 Component : libc Revision : 2.0: Interim Integer overflow in thestrxfrmfunction in the GNU C Library akaglibcor libc6 before 2.21 allows context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via a long string, which...

CVE-2017-8923

The zendstringextend function in Zend/zendstring.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact by leveraging a script's use ...

UBUNTU-CVE-2017-8923

The zendstringextend function in Zend/zendstring.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact by leveraging a script's use ...

PT-2017-2598

Name of the Vulnerable Software and Affected Versions PHP versions through 7.1.5 Description The issue is related to the zend string extend function in PHP, which does not prevent changes to string objects that result in a negative length. This allows remote attackers to cause a denial of service...

lrzip buffer overflow vulnerability

lrzip Long Range ZIP is an open source compression utility for large files. A buffer overflow vulnerability exists in the 'read1g' function in the stream.c file of liblrzip.so in lrzip version 0.631. A remote attacker can exploit this vulnerability to cause a denial of service heap buffer overflo...

lrzip denial of service vulnerability

lrzip Long Range ZIP is an open source compression utility for large files. A denial of service vulnerability exists in the lzo1xdecompress function in lrzip version 0.631 in zo1xd.ch. A remote attacker can exploit this vulnerability to cause a denial of service heap buffer overflow and applicati...

Cisco CallManager Express Unauthorized Access Vulnerability (cisco-sa-20170503-cme1)

A vulnerability in Cisco IOS Software for Cisco CallManager Express CME could allow an unauthenticated, remote attacker to make unauthorized phone calls. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Private Tunnel Denial of Service Vulnerability

Private Tunnel is a new way to achieve true Internet security, privacy and network protection by creating a virtual private network vpn. Private Tunnel suffers from a denial of service vulnerability that can be exploited by a local attacker to cause a denial of service via a long password...

Design/Logic Flaw

A vulnerability in Cisco IOS 15.53M Software for Cisco CallManager Express CME could allow an unauthenticated, remote attacker to make unauthorized phone calls. The vulnerability is due to a configuration restriction in the toll-fraud protections component of the affected software. An attacker...

CVE-2017-8367

Buffer overflow in Ether Software Easy MOV Converter 1.4.24, Easy DVD Creator, Easy MPEG/AVI/DIVX/WMV/RM to DVD, Easy Avi/Divx/Xvid to DVD Burner, Easy MPEG to DVD Burner, Easy WMV/ASF/ASX to DVD Burner, Easy RM RMVB to DVD Burner, Easy CD DVD Copy, MP3/AVI/MPEG/WMV/RM to Audio CD Burner,...

Dmitry Stack Buffer Overflow Vulnerability

DMitry Deepmagic Information Gathering Utility is a UNIX/GNU Linux command line program coded purely in C that gathers as much information about the host as possible. DMitry Deepmagic Information Gathering Tool suffers from a stack buffer overflow vulnerability that can be exploited by an attacke...

CVE-2017-7720

Buffer overflow in PrivateTunnel 2.7 and 2.8 allows local attackers to cause a denial of service SEH overwrite or possibly have unspecified other impact via a long password...

UBUNTU-CVE-2017-7938

Stack-based buffer overflow in DMitry Deepmagic Information Gathering Tool version 1.3a Unix allows attackers to cause a denial of service application crash or possibly have unspecified other impact via a long argument. An example threat model is automated execution of DMitry with hostname string...