RHEL 5 / 6 : mod_cluster-native (RHSA-2012:0037)

An updated modcluster-native package that fixes one security issue is now available for JBoss Enterprise Application Platform 5.1.2 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scorin...

RHEL 4 / 5 : jbossas (RHSA-2011:1309)

Updated jbossas packages that fix one security issue are now available for JBoss Enterprise Application Platform 4.2.0.CP09 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVS...

Java Applet AverageRangeStatisticImpl Remote Code Execution

This module abuses the AverageRangeStatisticImpl from a Java Applet to run arbitrary Java code outside of the sandbox, a different exploit vector than the one exploited in the wild in November of 2012. The vulnerability affects Java version 7u7 and earlier. This module requires Metasploit:...

java 7.x -- security manager bypass

US CERT reports: Java 7 Update 10 and earlier versions of Java 7 contain a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. The Java JRE plug-in provides its own Security Manager. Typically, a web applet runs with a security manager...

Cross site scripting

Cross-site scripting XSS vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript code that overrides methods of unspecified native objects in documents that have different origins...

CVE-2012-6464

Cross-site scripting XSS vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript code that overrides methods of unspecified native objects in documents that have different origins...

CVE-2012-5445

CVE-2012-5445 affects Cisco Unified IP Phone 7900 series (Cisco Native Unix kernel) prior to 9.3.1-ES10. The vulnerability arises from improper validation of unspecified kernel system calls in the TNP phones, enabling either arbitrary code execution or a memory overwrite-based denial of service w...

[SECURITY] Fedora 16 Update: pki-core-9.0.25-1.fc16

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D || ABOUT "CERTIFICATE SYSTEM" || =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D Certificate System CS is an enterprise software system...

[SECURITY] Fedora 17 Update: pki-core-9.0.25-1.fc17

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D || ABOUT "CERTIFICATE SYSTEM" || =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D Certificate System CS is an enterprise software system...

Opera < 12.10 Multiple Vulnerabilities

The version of Opera installed on the remote host is earlier than 12.10 and is, therefore, reportedly affected by the following vulnerabilities : - An error exists related to certificate revocation checking that can allow the application to indicate that a site is secure even though the check has...

Cross domain access to object constructors can be used to facilitate cross-site scripting – Opera Security Advisories

JavaScripts are able to redefine and override the methods of native objects. They may also do this with the native objects of any document that shares the same origin. By redefining the methods of another document through the constructor property of the document’s host objects, a malicious script...

Fedora Update for strongswan FEDORA-2012-8815

Check for the Version of strongswan OpenVAS Vulnerability Test Fedora Update for strongswan FEDORA-2012-8815 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Scientific Linux Security Update : tomcat6 on SL6.x

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. APR Apache Portable Runtime as mentioned in the CVE-2011-3190 and CVE-2011-2526 descriptions does not refer to APR provided by the apr packages. It refers to the implementation of APR provided by the...

ZDI-12-081 : Oracle Java GlueGen Arbitrary Native Library Loading Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-081 : Oracle Java GlueGen Arbitrary Native Library Loading Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-081 June 6, 2012 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Oracle - --...

Microsoft XML Core Services远程代码执行漏洞

CVE ID: CVE-2012-1889 Microsoft XML Core Services MSXML是一组服务，可用JScript、VBScript、Microsoft开发工具编写的应用构建基于XML的Windows-native应用。 Microsoft XML Core Services 3.0、4.0、5.0、6.0在实现上存在漏洞，可能导致访问未初始化内存对象进而发生内存破坏，远程攻击者可利用该漏洞在用户通过IE查看恶意网页时执行任意代码。 0 Microsoft XML Core Services 6.0 Microsoft XML Core Services 5.0...

Oracle Java GlueGen Arbitrary Native Library Loading Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists in the Java GlueGen library...

Buffer overflow and use-after-free issues found using Address Sanitizer — Mozilla

Security researcher Abhishek Arya of Google used the Address Sanitizer tool to uncover several issues: two heap buffer overflow bugs and a use-after-free problem. The first heap buffer overflow was found in conversion from unicode to native character sets when the function fails. The use-after-fr...

How to Break Google Chrome in Six Easy Steps

Browsers are a really nice target for attackers of all stripes and skill levels. But, unless you’re a savant or have just landed here from the future, you may want to take a pass on going after Google Chrome, judging by the insane level of effort and skill that an anonymous security researcher ha...

[SECURITY] Fedora 17 Update: openchange-1.0-6.fc17

OpenChange provides libraries to access Microsoft Exchange servers using native protocols...

Legacy Native Malware in Angry Birds Space to pwn your Android !

Legacy Native Malware in Angry Birds Space to pwn your Android A new malware threatens phones and tablets running Google's OS by hiding inside a copy of the popular game. Researchers at the mobile security firm Lookout identified the reworked malware as Legacy Native LeNa, which poses as a...