Downloads Resources over HTTP

Overview Affected versions of closurecompiler insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code...

Downloads Resources over HTTP

Overview Affected versions of appium-chromedriver insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read items send over HTTP at will. In this case, that includes the chromedriver binary, which may result in remote code...

SUSE SLES11 Security Update : vim (SUSE-SU-2016:2938-1)

This update for vim fixes the following security issues : - Fixed CVE-2016-1248, an arbitrary command execution vulnerability bsc1010685 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automaticall...

CentOS 7 : libreswan (CESA-2016:2603)

An update for libreswan is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Debian DLA-724-1 : mcabber security update

It was discovered that there was a 'roster push attack' 0 in mcabber, a console-based Jabber XMPP client. For Debian 7 'Wheezy', this issue has been fixed in mcabber version 0.10.1-3+deb7u1. We recommend that you upgrade your mcabber packages. 0...

Debian DLA-722-1 : irssi security update

An information disclosure vulnerability was found in irssi. CVE-2016-7553 Other users on the same machine as the user running irssi with buf.pl loaded may be able to retrieve the whole window contents after /UPGRADE. Furthermore, this dump of the windows contents is never removed afterwards. For...

CVE-2016-2927

IBM BigFix Remote Control before 9.1.3 is affected: it does not properly restrict the set of available encryption algorithms, enabling remote attackers to defeat cryptographic protections by sniffing the network and performing calculations on encrypted data. The issue is described across multiple...

SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2016:2893-1)

This update for sudo fixes the following issues : - fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality : - noexec bypass via system and popen CVE-2016-7032, bsc1007766 - noexec bypass via wordexp CVE-2016-7076, bsc1007501 Note that Tenable Network Security h...

Fedora 24 : perl-DBD-MySQL (2016-54fd3bf412)

Security fix for CVE-2016-1249 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

SUSE SLED12 / SLES12 Security Update : tar (SUSE-SU-2016:2896-1)

This update for tar fixes the following issues : - Fix the POINTYFEATHER vulnerability - GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path names specified on the command line bsc1007188 CVE-2016-6321 - Fix Amanda integration iss...

SUSE SLED12 / SLES12 Security Update : bash (SUSE-SU-2016:2872-1) (Shellshock)

This update for bash fixes the following issues : - CVE-2016-7543: Local attackers could have executed arbitrary commands via specially crafted SHELLOPTS+PS4 variables bsc1001299 - CVE-2016-0634: Malicious hostnames could have allowed arbitrary command execution when $HOSTNAME was expanded in the...

Debian DLA-717-1 : moin security update

Several cross-site scripting vulnerabilities were discovered in moin, a Python clone of WikiWiki. A remote attacker can conduct cross-site scripting attacks via the GUI editor's attachment dialogue CVE-2016-7146 and the GUI editor's link dialogue CVE-2016-9119. For Debian 7 'Wheezy', these proble...

CentOS Update for nss CESA-2016:2779 centos5

Check for the Version of nss SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882596";...

CVE-2016-9074

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services NSS 3.26.1. This vulnerability affects Thunderbird 45.5, Firefox ESR 45.5, and Firefox 50...

CVE-2016-9374

CVE-2016-9374 – AllJoyn denial of service in Wireshark : The AllJoyn dissector in Wireshark versions 2.2.0–2.2.1 and 2.0.0–2.0.7 could crash via a buffer over-read triggered by network traffic or capture files. The issue was addressed in epan/dissectors/packet-alljoyn.c by ensuring that a length ...

CVE-2016-9373

The CVE-2016-9373 issue affects Wireshark 2.2.0–2.2.1 and 2.0.0–2.0.7, where the DCERPC dissector could crash via a use-after-free triggered by network traffic or capture files. The root cause is private strings not scoped with wmem in epan/dissectors/packet-dcerpc-nt.c and epan/dissectors/packet...

Mozilla Network Security Services Information Disclosure Vulnerability

Mozilla Network Security Services NSS is the United States Mozilla Foundation developed a library network security services library, it can provide cross-platform support for SSL, S/MIME and other Internet security standards. An information disclosure vulnerability exists in Mozilla Network...

UBUNTU-CVE-2016-8635

It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group...

Mozilla Network Security Services Denial of Service Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation.Network Security Services NSS is a library Network Security Services library, which provides cross-platform support for SSL, S/MIME and other Internet security standards. Mozilla Network Security Services NSS is pro...

Multiple F5 BIG-IP Product Denial of Service Vulnerabilities

F5 BIG-IP ASM Application Security Manager is a network security product from F5 Corporation, U.S.A. ASM is a comprehensive web application firewall that protects applications and data from known and unknown threats, defends against Trojans that bypass standard protections, and patches...