At least one into the subject of mobile software vulnerabilities, some companies to grab the market does not consider security 9 0 after hacks said the hand tour“9 9% has a vulnerability” insiders suggested that the state of mobile software development of a unified standard of review-vulnerability warning-the black bar safety net

“It is a problem of the APP.” Xuhui Public Security Bureau network security detachment Bob Sergeant, record this phone the name of the software and is the“Black”of the symptoms. This is Bob the police officer and his colleagues made an experiment: they selected a certain influence of mobile phone...

NSS accepts export-length DHE keys with regular DHE cipher suites — Mozilla

Security researcher Matthew Green reported a Diffie–Hellman DHE key processing issue in Network Security Services NSS where a man-in-the-middle MITM attacker can force a server to downgrade TLS connections to 512-bit export-grade cryptography by modifying client requests to include only...

Debian DLA-260-1 : hostapd security update

A vulnerability was found in WMM Action frame processing in a case where hostapd is used to implement AP mode MLME/SME functionality i.e., Host AP driver of a mac80211-based driver on Linux. This vulnerability can be used to perform denial of service attacks by an attacker that is within radio...

Fedora 21 : abrt-2.3.0-7.fc21 / gnome-abrt-1.0.0-3.fc21 / libreport-2.3.0-8.fc21 (2015-10193)

Security fixes for : - CVE-2015-3315 - CVE-2015-3142 - CVE-2015-1869 - CVE-2015-1870 - CVE-2015-3151 - CVE-2015-3150 - CVE-2015-3159 abrt: ===== - Move the default dump location from /var/tmp/abrt to /var/spool/abrt - Use root for owner of all dump directories - Stop reading hserror.log from /tmp...

[SECURITY] Fedora 21 Update: openvas-libraries-8.0.3-2.fc21

openvas-libraries is the base library for the OpenVAS network security scanner...

Fedora 22 : python-jwt-1.3.0-1.fc22 (2015-10350)

Latest upstream with security fix for http://seclists.org/oss-sec/2015/q2/3 https://github.com/jpadilla/pyjwt/commit/88a9fc56bdc6c870aa6af93bda401 414a217db2a Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

Fedora 21 : python-jwt-1.3.0-1.fc21 (2015-10249)

Latest upstream with security fix for http://seclists.org/oss-sec/2015/q2/3 https://github.com/jpadilla/pyjwt/commit/88a9fc56bdc6c870aa6af93bda401 414a217db2a Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

SUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2015:1150-1) (Logjam)

This update fixes the following security issues : - CVE-2015-4000 boo931698 - The Logjam Attack / weakdh.org - reject connections with DH parameters shorter than 1024 bits - generates 2048-bit DH parameters by default - CVE-2015-1788 boo934487 - Malformed ECParameters causes infinite loop -...

Huawei Home Gateway UPnP/1.0 IGD/1.00 - Password Disclosure

!/usr/bin/python Exploit Title: Huawei Home Gateway password disclosure Date: June 27, 2015 Exploit Author: Fady Mohamed Osman @fadyosman Vendor Homepage: http://www.huawei.com/en/ Software Link: N/A. Version: UPnP/1.0 IGD/1.00 Tested on: HG530 - HG520b Provided by TE-DATA egypt Exploit-db :...

SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2015:1086-4) (Bar Mitzvah) (FREAK)

IBM Java 1.7.0 was updated to SR9 fixing security issues and bugs. Tabulated information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/IB MSecurityUpdateMay2015. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

Debian DLA-257-1 : libwmf security update

libwmf is vulnerable to two denial of service due to invalid read operations when processing specially crafted WMF files. CVE-2015-4695 Heap buffer overread in libwmf CVE-2015-4696 Read after free in wmf2gd/wmf2eps For the squeeze distribution, those issues have been fixed in libwmf...

Netgear Prosafe VPN Firewalls - Multiple vulnerabilities

About Encripto AS ================= Encripto is a Norwegian company which provides specialized services within IT-security. Our core expertise is security testing, network security monitoring and training. Encripto is committed to information security. We do research to discover trends, new...

Debian DLA-256-1 : t1utils security update

Jakub Wilk found a vulnerability in the Type 1 font manipulation programs, t1utils : CVE-2015-3905 Buffer overflow in the setcsstart function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted font file...

Debian DLA-255-1 : cacti security update

Several vulnerabilities cross-site scripting and SQL injection have been discovered in Cacti, a web interface for graphing of monitoring systems. We recommend that you upgrade your cacti packages. CVE-2015-2665 Cross-site scripting XSS vulnerability in Cacti before 0.8.8d allows remote attackers ...

SUSE SLED11 Security Update : flash-player (SUSE-SU-2015:1137-1)

Adobe Flash Player was updated to 11.2.202.468, fixing a security issue, where attackers could have triggered a heap overflow and could have executed code. https://helpx.adobe.com/security/products/flash-player/apsb15-1 4.html Note that Tenable Network Security has extracted the preceding...

Ubuntu 12.04 LTS : tomcat6 vulnerabilities (USN-2655-1)

It was discovered that Tomcat incorrectly handled data with malformed chunked transfer coding. A remote attacker could possibly use this issue to conduct HTTP request smuggling attacks, or cause Tomcat to consume resources, resulting in a denial of service. CVE-2014-0227 It was discovered that...

Moderate: Red Hat Security Advisory: nss security update

Updated nss and nss-util packages that fix one security issue, several bugs and add various enhancements are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

NSS: incorrectly permited skipping of ServerKeyExchange (MFSA 2015-71)

It was found that NSS permitted skipping of the ServerKeyExchange packet during a handshake involving ECDHE Elliptic Curve Diffie-Hellman key Exchange. A remote attacker could use this flaw to bypass the forward-secrecy of a TLS/SSL connection...

Fedora 20 : xen-4.3.4-6.fc20 (2015-9965)

Heap overflow in QEMU PCNET controller, allowing guest-host escape XSA-135, CVE-2015-3209 1230537 GNTTABOPswapgrantref operation misbehavior XSA-134, CVE-2015-4163 vulnerability in the iret hypercall handler XSA-136, CVE-2015-4164 Potential unintended writes to host MSI message data field via qem...

RHEL 7 : libreswan (RHSA-2015:1154)

Updated libreswan packages that fix one security issue, several bugs and add two enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...