FireEye - Malware Input Processor Privilege Escalation

FireEye - Malware Input Processor Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=670 The mip user is already quite privileged, capable of accessing sensitive network data. However, as the child process has supplementary gid contents, there is a very simple...

[SECURITY] Fedora 24 Update: qemu-2.5.0-10.fc24

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

[SECURITY] Fedora 23 Update: qemu-2.4.1-8.fc23

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

php: NULL pointer dereference in XSLTProcessor class

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language XSL transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT...

php: NULL pointer dereference in XSLTProcessor class

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language XSL transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT...

OpenSSL: Side channel attack on modular exponentiation

A side-channel attack was found that makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. An attacker who has the ability to control code in a thread running on the same hyper-threaded core as the victim's thread that is performing decryption, could use this flaw to...

Cisco NX-OS Software Denial of Service Vulnerability (CNVD-2016-01459)

Cisco NX-OS is a data center-class operating system. A security vulnerability exists in the SNMP input packet processor in the Cisco Nexus 5500/5600 platform switches, Cisco Nexus 6000 series switches, which can be exploited by an unauthenticated, remote attacker to cause an unintentional restart...

Vulnerability of the Office Web Apps Server web server, Microsoft Word and Word For Mac word processors, the Microsoft Office Compatibility Pack compatibility package, programs for reading Word Viewer doc files, the Microsoft SharePoint Server corporate application, which allows a hacker to execute arbitrary code.

The vulnerability in the Office Web Apps Server web server, Microsoft Word and Word For Mac text editors, the Microsoft Office Compatibility Pack, Word Viewer software for reading doc files, and the Microsoft SharePoint Server enterprise application is caused by a buffer overflow. Exploitation of...

Raspberry Pi 3 — New $35 MicroComputer with Built-in Wi-Fi and Bluetooth

While celebrating its computer's fourth birthday, the Raspberry Pi Foundation has launched a brand new Raspberry Pi today. Great news for all Micro-computing fans – A new, powerful Raspberry Pi 3 Model B in town. Months after introducing just $5 Raspberry Pi Zero, Raspberry Pi Foundation has...

[SECURITY] Fedora 22 Update: libreoffice-4.4.7.2-3.fc22

LibreOffice is an Open Source, community-developed, office productivity sui te. It includes the key desktop applications, such as a word processor, spreadsheet, presentation manager, formula editor and drawing program, with a user interface and feature set similar to other office suites...

[SECURITY] Fedora 22 Update: qemu-2.3.1-12.fc22

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

[SECURITY] Fedora 23 Update: qemu-2.4.1-7.fc23

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20160216)

It was found that the Linux kernel's keys subsystem did not correctly garbage collect uninstantiated keyrings. A local attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system. CVE-2015-7872, Important - A flaw was found in the way the Linux kernel...

CentOS 7 : kernel (CESA-2016:0185)

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, a...

389-ds-base: worker threads do not detect abnormally closed connections causing DoS

An infinite-loop vulnerability was discovered in the 389 directory server, where the server failed to correctly handle unexpectedly closed client connections. A remote attacker able to connect to the server could use this flaw to make the directory server consume an excessive amount of CPU and st...

Warning — Setting This Date On iPhone Or iPad Will Kill Your Device Permanently

Don’t Try this at Home! An interesting software bug has been discovered in Apple's iOS operating system that could kill your iPhone, iPad or iPod Dead Permanently. Yes, you heard me right. An issue with the date and time system in iOS had emerged recently when Reddit users started warning people...

ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D...

ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D...

ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D...

ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D...