JBossWS remote Denial of Service

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterpris...

Important: Red Hat Security Advisory: jbossws-common security update

An updated jbossws-common.jar file for JBoss Enterprise Web Platform 5.1.1 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...

CVE-2011-1966

The CVE-2011-1966 issue affects Microsoft Windows DNS Server on Windows Server 2008 SP2, R2, and R2 SP1, where the DNS server mishandles NAPTR queries that trigger recursive processing. The root cause is a memory corruption vulnerability exploitable via specially crafted NAPTR queries, which can ...

BIND -- Remote DoS against authoritative and recursive servers

ISC reports: A defect in the affected BIND 9 versions allows an attacker to remotely cause the "named" process to exit using a specially crafted packet. This defect affects both recursive and authoritative servers...

Path traversal

Absolute path traversal vulnerability in xftpd in the FTP Server component in Apple Mac OS X before 10.6.8 allows remote attackers to list arbitrary directories by using the root directory as the starting point of a recursive listing...

DEBIAN-CVE-2011-1753

expaterl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of neste...

Fedora Update for unbound FEDORA-2011-7555

Check for the Version of unbound OpenVAS Vulnerability Test Fedora Update for unbound FEDORA-2011-7555 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Fedora 13 : apr-1.4.5-1.fc13 (2011-7340)

Move to 1.4.x branch. Various bug fixes since 1.4.2. Security: CVE-2011-0419 Reimplement aprfnmatch from scratch using a non-recursive algorithm; now has improved compliance with the fnmatch spec. Note: 1.4.3 was never officially released. Fix CVE-2011-1928 introduced in 1.4.4. Note that Tenable...

Fedora 14 : apr-1.4.5-1.fc14 (2011-6918)

Move to 1.4.x branch. Various bug fixes since 1.4.2. Security: CVE-2011-0419 Reimplement aprfnmatch from scratch using a non-recursive algorithm; now has improved compliance with the fnmatch spec. Note: 1.4.3 was never officially released. Fix CVE-2011-1928 introduced in 1.4.4. Note that Tenable...

Fedora 15 : apr-1.4.5-1.fc15 (2011-6750)

Various bug fixes since 1.4.2. Security: CVE-2011-0419 Reimplement aprfnmatch from scratch using a non-recursive algorithm; now has improved compliance with the fnmatch spec. Note: 1.4.3 was never officially released. Release -2 should fix topbuilddir problem from -1. Fix CVE-2011-1928 introduced...

CVE-2010-4807

CVE-2010-4807 affects IBM Web Content Manager (WCM) 7.0.0.1 before CF003. The issue is a race condition that allows remote authenticated users to trigger a denial of service via an infinite recursive query, linked to a StackOverflowError. Documents do not specify the exact vulnerable component, v...

[slackware-security] apr/apr-util

New apr and apr-util packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix a security issue. Here are the details from the Slackware 13.37 ChangeLog: patches/packages/apr-1.4.4-i486-1slack13.37.txz: Upgraded. This fixes a possible denial of service du...

Apache APR -- DoS vulnerabilities

The Apache Portable Runtime Project reports: Note especially a security fix to APR 1.4.4, excessive CPU consumption was possible due to an unconstrained, recursive invocation of aprfnmatch, as aprfnmatch processed '' wildcards. Reimplement aprfnmatch from scratch using a non-recursive algorithm n...

CVE-2007-6743

Double free vulnerability in IBM Tivoli Directory Server TDS 5.2 before 5.2.0.5-TIV-ITDS-LA0005 allows remote authenticated users to cause a denial of service ABEND via search operations that trigger recursive filterfree calls...

SuSE 11.1 Security Update : Mozillla Firefox (SAT Patch Number 4104)

Mozilla Firefox has been updated to version 3.6.15, fixing the following security issues : - Several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products have been identified and fixed. Some of these bugs showed evidence of memory corruption under certain...

Debian DSA-2187-1 : icedove - several vulnerabilities

Several vulnerabilities have been discovered in Icedove, an unbranded version of the Thunderbird mail/news client. - CVE-2010-1585 Roberto Suggi Liverani discovered that the sanitising performed by ParanoidFragmentSink was incomplete. - CVE-2011-0051 Zach Hoffmann discovered that incorrect parsin...

Mozilla Foundation Security Advisory 2011-02

Mozilla Foundation Security Advisory 2011-02 Title: Recursive eval call causes confirm dialogs to evaluate to true Impact: Critical Announced: March 1, 2011 Reporter: Zach Hoffman Products: Firefox, SeaMonkey Fixed in: Firefox 3.6.14 Firefox 3.5.17 SeaMonkey 2.0.12 Description Security researcher...

CVE-2011-0051

Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, does not properly handle certain recursive eval calls, which makes it easier for remote attackers to force a user to respond positively to a dialog question, as demonstrated by a question about granting privileges...

CVE-2011-0051

Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, does not properly handle certain recursive eval calls, which makes it easier for remote attackers to force a user to respond positively to a dialog question, as demonstrated by a question about granting privileges...

Mozilla recursive eval call causes confirm dialog to evaluate to true (MFSA 2011-02)

Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, does not properly handle certain recursive eval calls, which makes it easier for remote attackers to force a user to respond positively to a dialog question, as demonstrated by a question about granting privileges...