WNC01WH vulnerable to enabling debug option

Overview WNC01WH provided by BUFFALO INC. is a network camera. WNC01WH contains an enabling debug option vulnerability. Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warnin...

Downloads Resources over HTTP

Overview Affected versions of clang-extra insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution ...

CVE-2016-8734

Apache Subversion's moddontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory...

USN-3139-1 vim vulnerability

Florian Larysch discovered that the Vim text editor did not properly validate values for the 'filetype', 'syntax', and 'keymap' options. An attacker could trick a user into opening a file with specially crafted modelines and possibly execute arbitrary code with the user's privileges...

PT-2016-4671 · Mysql Server +3 · Dbd::Mysql +3

Name of the Vulnerable Software and Affected Versions: DBD::mysql versions 3.x and 4.x before 4.041 Description: The issue is related to a use-after-free vulnerability. It affects the DBD::mysql driver when used with the option mysql server prepare=1. Recommendations: For DBD::mysql versions 3.x...

Vim Input Validation Vulnerability

Vim is an open-source, configurable text editor for creating and changing any type of text, which can be used on most UNIX systems and Apple OS X. It can be used to create and change any type of text. A security vulnerability in versions prior to Vim patch 8.0.0056 stems from the program's failur...

DEBIAN-CVE-2016-1248

vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened...

PT-2016-4670 · Vim +5 · Vim +5

Name of the Vulnerable Software and Affected Versions: vim versions prior to 8.0.0056 Description: The issue arises from improper validation of values for the filetype, syntax, and keymap options. This can lead to the execution of arbitrary code when a file with a specially crafted modeline is...

CVE-2016-9318

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity XXE attacks via a crafte...

util-linux security, bug fix, and enhancement update

2.23.2-33.0.1 - fix Oracle bug 23001516 - backport lscpu: correct the Virtualization type on Xen DomU PV guest - Reviewed-by: Joe Jin 2.23.2-33 - improve patch for 1007734 libblkid realpaths 2.23.2-32 - improve patch for chrt1 deadline support 1298384 - fix 1007734 - blkid shows devices as...

IQ Option - Binary Options - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application IQ Option - Binary Options published at the 'play' market has multiple vulnerabilities...

OOB write via unchecked multiplication

In libcurl's base64 encode function, the output buffer is allocated as follows without any checks on insize: malloc insize 4 / 3 + 4 On systems with 32-bit addresses in userspace e.g. x86, ARM, x32, the multiplication in the expression wraps around if insize is at least 1GB of data. If this...

UBUNTU-CVE-2016-8617

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via CURLOPTUSERNAME...

CVE-2016-6828

The tcpchecksendhead function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service tcpxmitretransmitqueue use-after-free and system crash via a crafted SACK option...

SOL01471335 - BIND vulnerability CVE-2016-2848

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SUSE-SU-2016:2570-1 Security update for samba

This update for samba provides the following fix: Following security issue was fixed: - CVE-2016-2119: Prevent client-side SMB2 signing downgrade. bsc986869 Also the following bugs were fixed: - Fix possible ctdb crash when opening sockets with htonsIPPROTORAW. bsc969522 - Honor smb.conf socket...

CVE-2016-6828

The tcpchecksendhead function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service tcpxmitretransmitqueue use-after-free and system crash via a crafted SACK option...

Code injection

The tcpchecksendhead function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service tcpxmitretransmitqueue use-after-free and system crash via a crafted SACK option...

CVE-2016-6828

The tcpchecksendhead function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service tcpxmitretransmitqueue use-after-free and system crash via a crafted SACK option...

CVE-2016-6828

The vulnerability CVE-2016-6828 affects the Linux kernel and is triggered by a local attacker exploiting a use-after-free in the TCP transmit path. Specifically, the tcp_check_send_head path in include/net/tcp.h leaves SACK state in an inconsistent condition after a failed data copy, enabling a l...