Ubuntu: Security Advisory (USN-2974-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS : QEMU vulnerabilities (USN-2974-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2974-1 advisory. Zuozhi Fzz discovered that QEMU incorrectly handled USB OHCI emulation support. A privileged attacker inside the guest could use this issue t...

USN-2974-1 qemu, qemu-kvm vulnerabilities

Zuozhi Fzz discovered that QEMU incorrectly handled USB OHCI emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. CVE-2016-2391 Qinghao Tang discovered that QEMU incorrectly handled USB Net emulation support. A...

CVE-2016-2858

QEMU, when built with the Pseudo Random Number Generator PRNG back-end support, allows local guest OS users to cause a denial of service process crash via an entropy request, which triggers arbitrary stack based allocation and memory corruption...

Stack overflow

QEMU, when built with the Pseudo Random Number Generator PRNG back-end support, allows local guest OS users to cause a denial of service process crash via an entropy request, which triggers arbitrary stack based allocation and memory corruption...

CVE-2016-2858

QEMU, when built with the Pseudo Random Number Generator PRNG back-end support, allows local guest OS users to cause a denial of service process crash via an entropy request, which triggers arbitrary stack based allocation and memory corruption...

CVE-2016-2858

CVE-2016-2858 – QEMU PRNG back-end: Local guest OS users can trigger a denial of service by requesting entropy, causing arbitrary stack-based allocations and memory corruption. The issue is specific to builds with PRNG back-end support and results in a QEMU process crash. Connected documents conf...

CVE-2016-2858

QEMU, when built with the Pseudo Random Number Generator PRNG back-end support, allows local guest OS users to cause a denial of service process crash via an entropy request, which triggers arbitrary stack based allocation and memory corruption...

Fedora 23 : prosody-0.9.9-2.fc23 (2016-38e48069f8)

Prosody 0.9.9 ============= A summary of changes: Security fixes -------------- Fix path traversal vulnerability in modhttpfiles CVE-2016-1231 Fix use of weak PRNG in generation of dialback secrets CVE-2016-1232 Bugs ---- Improve handling of CNAME records in DNS Fix traceback when deleting a user...

prosody: Security update (2 CVEs)

The prosody package has been rebuilt and was uploaded to the Chaos Calmer 15.05 repository due to multiple security issues. VERSION 0.9.8-1 = 0.9.9-1 CHANGELOG Mon, 25 Jan 2016 13:31:29 +0100 bb23089 fixes: path traversal vulnerability in modhttpfiles CVE-2016-1231 use of weak PRNG in generation ...

Horizon HD / WiFi Weak WiFi Passphrase Generation

---------------------------------------------------------------------------- Advisory ID: HCA0005 - http://hackingcorp.ch/advisories/HCA0005.pdf Product: Horizon HD / WiFi Vendor: Liberty Global plc companies Unitymedia GmbH, UPC Cablecom, ... Affected Versions: unknown Tested Versions: current...

Debian DLA-391-1 : prosody security update

It was discovered that in prosody, a Lightweight Jabber/XMPP server, used a weak PRNG in the moddialback module. For Debian 6 Squeeze, this issue has been fixed in prosody version 0.7.0-1squeeze1+deb6u1. NOTE: Tenable Network Security has extracted the preceding description block directly from th...

DLA-391-1 prosody - security update

Bulletin has no description...

FreeBSD : prosody -- multiple vulnerabilities (842cd117-ba54-11e5-9728-002590263bf5)

The Prosody Team reports : Fix path traversal vulnerability in modhttpfiles CVE-2016-1231 Fix use of weak PRNG in generation of dialback secrets CVE-2016-1232 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBS...

Juniper Removes Dual_EC, ANSI X9.31 Algorithms

Juniper Networks announced late Friday it was removing the suspicious DualECDRBG random number generator from its ScreenOS operating system. And while that’s heralded as a positive move considering DualEC’s dubious origins, there remain important and unanswered questions about Juniper’s decision ...

prosody -- multiple vulnerabilities

The Prosody Team reports: Fix path traversal vulnerability in modhttpfiles CVE-2016-1231 Fix use of weak PRNG in generation of dialback secrets CVE-2016-1232...

CVE-2015-2913

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict...

Design/Logic Flaw

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict...

CVE-2015-2913

OrientDB Server Community Edition prior to 2.0.15 and 2.1.x prior to 2.1.1 is affected by CVE-2015-2913 due to using java.util.Random for Session ID generation in server/network/protocol/http/OHttpSessionManager.java, which can allow remote attackers to predict session IDs. The issue is documente...

OpenSSL Multiple Vulnerabilities (20150319 - 2) - Windows

OpenSSL is prone to multiple vulnerabilities. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...