Fedora 18 : LibRaw-0.14.8-3.fc18.20120830git98d925 (2013-15576)

Raphael Geissert reported two denial of service flaws in LibRaw 1 : CVE-2013-1438 : Specially crafted photo files may trigger a division by zero, an infinite loop, or a NULL pointer dereference in libraw leading to denial of service in applications using the library. These vulnerabilities appear ...

FreeBSD-SA-13:12.ifioctl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:12.ifioctl Security Advisory The FreeBSD Project Topic: Insufficient credential checks in network ioctl2 Category: core Module: sysnetinet6 sysnetatm Announced...

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : python-httplib2 vulnerability (USN-1948-1)

It was discovered that httplib2 only validated SSL certificates on the first request to a connection, and didn't report validation failures on subsequent requests. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could possibly be exploited in certain scenarios to...

Siemens SINAMICS S/G Authentication Bypass Vulnerability

OVERVIEW Siemens has identified an authentication bypass vulnerability in the SINAMICS S/G product family. Siemens has produced a firmware update that mitigates this vulnerability and has tested the update to validate that it resolves the vulnerability. Exploitation of this vulnerability could...

Elecsys Director Gateway Improper Input Validation Vulnerability

OVERVIEW Adam Crain of Automatak and independent researchers Chris Sistrunk and Adam Todorski have identified an improper input validation in the Elecsys Director Gateway application. Elecsys has produced a patch that mitigates this vulnerability. Adam Todorski has tested the patch to validate th...

Fedora 18 : glibc-2.16-34.fc18 (2013-15072)

glibc security update : CVE-2013-2207 glibc ptchown: Improper pseudotty ownership and permissions changes when granting access to the slave pseudoterminal The fix may break chroots if their devpts was not mounted correctly. Fix is to mount the devpts correctly with gid=5. Note that Tenable Networ...

Cisco Network Admission Control (NAC) Version

The remote host is a Cisco Network Admission Control NAC Manager. It is possible to read the NAC version by connecting to the switch using SSH. TRUSTED...

Amazon Linux AMI : kernel (ALAS-2012-83)

It was found that the datalen parameter of the sockallocsendpskb function in the Linux kernel's networking implementation was not validated before use. A local user with access to a TUN/TAP virtual interface could use this flaw to crash the system or, potentially, escalate their privileges. Note...

OpenStack: Nova network source security groups denial of service

Algorithmic complexity vulnerability in OpenStack Compute Nova before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users to cause a denial of service nova-network consumption via a large number of...

Fedora 18 : php-pear-Auth-OpenID-2.2.2-7.fc18 (2013-15253)

Fix for CVE-2013-4701 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-2747-1 : cacti - several vulnerabilities

Two vulnerabilities were discovered in Cacti, a web interface for graphing of monitoring systems : - CVE-2013-5588 install/index.php and cacti/host.php suffered from Cross-Site Scripting vulnerabilities. - CVE-2013-5589 cacti/host.php contained a SQL injection vulnerability, allowing an attacker ...

Fedora 19 : ssmtp-2.64-9.fc19 (2013-15049)

Use a corrected patch to validate server certificates Removes world read access from the configuration file thus prohibiting reading of password stored inside it. Removes world read access from the configuration file thus prohibiting reading of password stored inside it. Note that Tenable Network...

Fedora 18 : ansible-1.2.3-2.fc18 (2013-15181)

Fixes CVE-2013-4260 and CVE-2013-4259 See https://groups.google.com/forum/!topic/ansible-project/UVDYW0HGcNg for more information. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically...

Websense Email Security Installed

Websense Email Security, an email security application, is installed on the remote Windows host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69516; scriptversion"1.7"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/02/06";...

Fedora 19 : roundcubemail-0.9.3-2.fc19 (2013-15221)

Two XSS flaws were fixed in roundcube 0.9.3 1 : - Fix XSS vulnerability when saving HTML signatures 2,3 - Fix XSS vulnerability when editing a message 'as new' or draft 2,4 1 http://trac.roundcube.net/wiki/ChangelogRELEASE0.9.3 2 http://trac.roundcube.net/ticket/1489251 3...

Triangle Research Nano-10 PLC Improper Input Validation

OVERVIEW Researcher Wei Gao of IXIA has identified an improper input validation vulnerability in Triangle Research International, Inc.’s TRi Inc. Nano‑10 programmable logic controller PLC.IXIA Web site...

Fedora 19 : python3-3.3.2-6.fc19 (2013-15254)

Fix for CVE-2013-4238 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

nss: TLS CBC padding timing attack

The TLS implementation in Mozilla Network Security Services NSS does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attac...

Mozilla: Out-of-bounds array read in CERT_DecodeCertPackage (MFSA 2013-40)

The CERTDecodeCertPackage function in Mozilla Network Security Services NSS, as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to cause a denial ...

Fedora 19 : php-symfony2-HttpFoundation-2.2.5-1.fc19 (2013-14608)

Updated to 2.2.5 CVE-2013-4752 Request::getHost poisioning Release blog posts : - http://symfony.com/blog/symfony-2-2-4-released - http://symfony.com/blog/security-releases-symfony-2-0- 24-2-1-12-2-2-5-and-2-3-3-released Full change log:...