SUSE-SU-2016:2418-1 Security update for postgresql94

This update for postgresql94 to version 9.4.9 fixes the several issues. These security issues were fixed: - CVE-2016-5423: CASE/WHEN with inlining can cause untrusted pointer dereference bsc993454. - CVE-2016-5424: Fix client programs' handling of special characters in database and role names...

Streamo Online Radio And TV Streaming CMS SQL Injection Vulnerability

Streamo Online Radio And TV Streaming CMS is a popular online radio and TV streaming content management system. A SQL injection vulnerability exists in the id parameter of the programs.php page of Streamo Online Radio And TV Streaming CMS, which can be exploited by an attacker to take control of...

CVE-2016-7543

An arbitrary command injection flaw was found in the way bash processed the SHELLOPTS and PS4 environment variables. A local, authenticated attacker could use this flaw to exploit poorly written setuid programs to elevate their privileges under certain circumstances...

iSpy Keylogger Targets Passwords, Skype, Webcams

Researchers are monitoring sales and infection rates of a new keylogger being sold on the dark web for $25 to $35. Along with capturing keystrokes, iSpy grabs passwords stored in web browsers, records Skype chats, takes webcam screenshots and steals the license keys of software such as Adobe...

Snowden Slammed by House Committee Report

Edward Snowden’s hopes of a presidential pardon were dimmed Thursday when a House Committee report slammed the former U.S. defense contractor saying he has done “tremendous damage” to United States national security. That conclusion was part of a 36-page report PDF released Thursday by the House...

HackerOne: Ability to enumerate private programs using SAML

@ayoubfathi found a strong indicator of the existence of some private programs which were using SAML. Although it was not definitive, and we also warn teams using SAML that doing so removes their reasonable expectation of not being discoverable, we made some changes to help teams more easily...

Updated postgresql packages fix security vulnerability

It was discovered that certain SQL statements containing CASE/WHEN commands could crash the PostgreSQL server, or disclose a few bytes of server memory, potentially leading to arbitrary code execution CVE-2016-5423. It was found that PostgreSQL client programs mishandle database and role names...

[SECURITY] Fedora 25 Update: postgresql-9.5.4-1.fc25

PostgreSQL is an advanced Object-Relational database management system DBM S. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine ...

[SECURITY] Fedora 24 Update: postgresql-9.5.4-1.fc24

PostgreSQL is an advanced Object-Relational database management system DBM S. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine ...

Tomcat: CGI sets environmental variable based on user supplied Proxy request header

It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker coul...

postgresql: multiple issues

CVE-2016-5423 arbitrary code execution It was discovered that certain SQL statements containing CASE/WHEN commands could crash the PostgreSQL server, or disclose a few bytes of server memory, potentially leading to arbitrary code execution. - CVE-2016-5424 privilege escalation It was found that...

Microsoft Graphics Component Multiple Remote Code Execution Vulnerabilities (3177393)

This host is missing an important security update according to Microsoft Bulletin MS16-097. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

mysql: unspecified vulnerability related to Client programs (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs...

nawakaya.lk XSS vulnerability

Vulnerable URL: http://nawakaya.lk/lankan-tv-programs/search/?q=%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%2FXSSPOSED%2F%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the sndfile-programs package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

The vulnerability in Microsoft.NET Framework software allows a malicious attacker to compromise the confidentiality, integrity, and accessibility of protected information.

A vulnerability that allows for remote execution of code exists in the Microsoft .NET Framework. This vulnerability is related to incorrect handling of localized resource identifiers. Exploiting this vulnerability enables a malicious individual to gain full control over the system. They can then...

The vulnerability of the embedded software on FANUC 32i numerical control machines allows a malicious individual to disrupt the TCP/IP stack’s operation and cause malfunctions during maintenance.

The software of FANUC 32i numerical control machines contains a vulnerability related to the incorrect processing of fragmented programs. Exploiting this vulnerability allows a malicious individual to disrupt the TCP/IP stack by sending certain fragmented programs, thereby causing service failure...

The vulnerability of the Firefox browser, which allows attackers to carry out XSS attacks

The vulnerability of Firefox browsers exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using specially created applications...

CVE-2016-5361: Improper Input Validation

programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service traffic amplification via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from...

gnutls: arbitrary file overwrite

Setuid programs using GnuTLS could potentially allow an attacker to overwrite and corrupt arbitrary files in the filesystem. This issue was introduced in GnuTLS 3.4.12 with the GNUTLSKEYLOGFILE environment variable handling via getenv and fixed in GnuTLS 3.4.13 by switching to securegetenv where...