FreeBSD : p5-UI-Dialog -- shell command execution vulnerability (00dadbf0-6f61-11e5-a2a1-002590263bf5)

Matthijs Kooijman reports : It seems that the whiptail, cdialog and kdialog backends apply some improper escaping in their shell commands, causing special characters present in menu item titles to be interpreted by the shell. This includes the backtick evaluation operator, so this constitutes a...

FreeBSD : p5-Dancer -- possible to abuse session cookie values (968d1e74-1740-11e5-a643-40a8f0757fb4)

Russell Jenkins reports : It was possible to abuse session cookie values so that file-based session stores such as Dancer::Session::YAML or Dancer2::Session::YAML would attempt to read/write from any file on the filesystem with the same extension the file-based store uses, such as '.yml' for the...

Duqu Resurfaces With New Round of Victims, Including Kaspersky Lab

The Duqu attackers, who are considered by researchers to be at the top of the food chain of APT groups and are responsible for attacking certificate authorities and perhaps spying on Iran’s nuclear program, have resurfaced with a new platform that was used to compromise high-profile victims,...

FreeBSD Ports: p5-RT-Authen-ExternalAuth

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: p5-RT-Authen-ExternalAuth

The remote host is missing an update to the system as announced in the referenced advisory. VID cdc4ff0e-d736-11e1-8221-e0cb4e266481 OpenVAS Vulnerability Test $ Description: Auto generated from VID cdc4ff0e-d736-11e1-8221-e0cb4e266481 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

FreeBSD : p5-RT-Authen-ExternalAuth -- privilege escalation (cdc4ff0e-d736-11e1-8221-e0cb4e266481)

The RT development team reports : RT::Authen::ExternalAuth 0.10 and below for all versions of RT are vulnerable to an escalation of privilege attack where the URL of a RSS feed of the user can be used to acquire a fully logged-in session as that user. CVE-2012-2770 has been assigned to this...

Iran Discovers "Massive Cyber Attack," Points Finger at US, UK, Israel

Iran’s intelligence minister Heydar Moslehi claims the country has uncovered a “massive cyber attack” it believes was jointly launched by the United States, England and Israel, according to reports from PressTV, Iran’s state-owned English language news network, yesterday. “Based on obtained...

FreeBSD : p5-Config-IniFiles -- unsafe temporary file creation (725ab25a-987b-11e1-a2ef-001fd0af1a4c)

Unsafe Temporary file creation Config::IniFiles used a predictable name for its temporary file without opening it correctly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

Security fix for the ALT Linux 5 package fetchmail version 6.3.21-alt1.0.M50P.1

Dec. 1, 2011 Gleb Fotengauer-Malinovskiy 6.3.21-alt1.0.M50P.1 - Backport to p5 branch CVE-2011-1947...

Security fix for the ALT Linux 5 package pidgin-mini version 2.10.0-alt0.M50P.1

Oct. 3, 2011 Gleb Fotengauer-Malinovskiy 2.10.0-alt0.M50P.1 - Backport to p5 branch new version, CVE-2011-2485...

Security fix for the ALT Linux 5 package pidgin-mini version 2.9.0-alt2.M50P.1

Aug. 23, 2011 Gleb Fotengauer-Malinovskiy 2.9.0-alt2.M50P.1 - backport to p5 branch CVE-2011-2485...

Security fix for the ALT Linux 5 package subversion version 1.6.16-alt0.M50P.1

April 18, 2011 Gleb Fotengauer-Malinovskiy 1.6.16-alt0.M50P.1 - Backport to p5 branch fixes CVE-2011-0715...

Security fix for the ALT Linux 5 package libxml2 version 1:2.7.8-alt3.M50P.1

Jan. 20, 2011 Andrey Cherepanov 1:2.7.8-alt3.M50P.1 - backport to p5 branch fixes CVE-2010-4494...

Security fix for the ALT Linux 5 package gnome-vfs version 1:2.24.4-alt0.M50P.1

Nov. 13, 2010 Andrey Cherepanov 1:2.24.4-alt0.M50P.1 - backport to p5 branch fixed CVE-2009-2473...

Security fix for the ALT Linux 5 package subversion version 1.6.13-alt0.M50P.1

Nov. 12, 2010 Andrey Cherepanov 1.6.13-alt0.M50P.1 - backport to p5 branch fixed CVE-2010-3315...

Security fix for the ALT Linux 5 package memcached version 1.4.5-alt1.M50P.1

Nov. 12, 2010 Andrey Cherepanov 1.4.5-alt1.M50P.1 - backport to p5 fixed CVE-2010-1152...

FreeBSD Ports: p5-libwww

The remote host is missing an update to the system as announced in the referenced advisory. VID 3a7c5fc4-b50c-11df-977b-ecc31dd8ad06 OpenVAS Vulnerability Test $ Description: Auto generated from VID 3a7c5fc4-b50c-11df-977b-ecc31dd8ad06 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

FreeBSD : p5-libwww -- possibility to remote servers to create file with a .(dot) character (3a7c5fc4-b50c-11df-977b-ecc31dd8ad06)

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a .' dot character, which allows remote servers to create or overwrite files via a 3xx redirect to a URL with a crafted filename or a Content-Disposition header that suggests a crafted filename, and...

Security fix for the ALT Linux 5 package openldap2.4 version 2.4.23-alt0.M50P.1

July 1, 2010 Andrey Cherepanov 2.4.23-alt0.M50P.1 - backport to p5 branch security fixes: CVE-2010-0212 and CVE-2010-0211...

p5-libwww -- possibility to remote servers to create file with a .(dot) character

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a .' dot character, which allows remote servers to create or overwrite files via a 3xx redirect to a URL with a crafted filename or a Content-Disposition header that suggests a crafted filename, and...