[USN-2391-1] php5 vulnerabilities

========================================================================== Ubuntu Security Notice USN-2391-1 October 30, 2014 php5 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

PT-2015-1689

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 0.9.8s OpenSSL versions 1.0.0 prior to 1.0.0e OpenSSL versions 1.0.1 prior to 1.0.1n OpenSSL versions 1.0.2 prior to 1.0.2b Description The issue is related to the BN GF2m mod inv function in OpenSSL, which does not...

Cross site scripting

Cross-site scripting XSS vulnerability in the japurity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod cookie parameter to html/modules.php...

CVE-2012-2413

Cross-site scripting XSS vulnerability in the japurity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod cookie parameter to html/modules.php...

PT-2014-2246

Name of the Vulnerable Software and Affected Versions Joomla! versions 1.5.26 and earlier Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the Mod cookie parameter to the "html/modules.php" endpoint...

CVE-2012-2413: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the japurity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod cookie parameter to html/modules.php...

UBUNTU-CVE-2014-3581

The cachemergeheadersout function in modules/cache/cacheutil.c in the modcache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via an empty HTTP Content-Type header...

UBUNTU-CVE-2014-6277

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service uninitialized memory access, and untrusted-pointer read and write operations via a crafted...

UBUNTU-CVE-2014-6271

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the modcgi and modcg...

CVE-2014-3617

The CVE-2014-3617 issue affects Moodle’s forum: the function forum_print_latest_discussions in mod/forum/lib.php allowed remote authenticated users to bypass the requirement to post an answer and to discover an author’s username by visiting a Q&A forum, without needing the mod/forum:viewqandawith...

CVE-2014-3617

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

PT-2014-5422

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.4.11 Moodle versions 2.5.x prior to 2.5.8 Moodle versions 2.6.x prior to 2.6.5 Moodle versions 2.7.x prior to 2.7.2 Description The issue allows remote authenticated users to bypass the individual answer-posting...

Ubuntu: Security Advisory (USN-2344-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2014-5404

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.11 Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash, by sending an empty HTTP Content-Type header. This is due to...

CVE-2014-5508

Multiple integer overflows in the HelpServ module mod-helpserv.c in srvx 1.3.1 allow remote authenticated IRCops or HelpServ bot managers to cause a denial of service infinite loop via a large value in the EmptyInterval parameter or certain other interval configurations...

CVE-2014-5508: Undefined Security Weakness

Multiple integer overflows in the HelpServ module mod-helpserv.c in srvx 1.3.1 allow remote authenticated IRCops or HelpServ bot managers to cause a denial of service infinite loop via a large value in the EmptyInterval parameter or certain other interval configurations...

PT-2014-6415

Name of the Vulnerable Software and Affected Versions innovaphone PBX versions 10.00 sr11 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that modify configurations or user accounts. This can be achieved through crafted request...

SUSE-RU-2015:0591-1 Recommended update for apache2-mod_nss

This update brings several improvements to apache2-modnss. More TLS 1.2 ciphers have been added, including AES-GCM and Camelia ciphers. These can be selected by their tags: o rsaaes128sha256 o rsaaes128gcmsha o rsaaes256sha256 o rsacamellia128sha o rsacamellia256sha o ecdhecdsaaes128gcmsha o...

httpd: mod_cgid denial of service

A denial of service flaw was found in the way httpd's modcgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely...

httpd: mod_deflate denial of service

A denial of service flaw was found in the way httpd's moddeflate module handled request body decompression configured via the "DEFLATE" input filter. A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and C...