python-django: permission bypass

If a ModelAdmin uses saveas=True not the default, the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission...

Debian DLA-407-1 : prosody security update

The flaw allows a malicious server to impersonate the vulnerable domain to any XMPP domain whose domain name includes the attacker's domain as a suffix. For example, 'bber.example' would be able to connect to 'jabber.example' and successfully impersonate any vulnerable server on the network. This...

[SECURITY] [DLA 407-1] prosody security update

Package : prosody Version : 0.7.0-1squeeze1+deb6u2 CVE ID : CVE-2016-0756 The flaw allows a malicious server to impersonate the vulnerable domain to any XMPP domain whose domain name includes the attackers domain as a suffix. For example, bber.example would be able to connect to jabber.example an...

DLA-407-1 prosody - security update

Bulletin has no description...

Debian DLA-385-2 : isc-dhcp regression update

With the previous upload of the isc-dhcp package to Debian Squeeze LTS two issues got introduced into LTS that are resolved by this upload. 1 CVE-2015-8605 had only been resolved for the LDAP variant of the DHCP server package built from the isc-dhcp source package. With upload of version...

[SECURITY] [DSA 3431-2] ganeti regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3431-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 14, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3431-2] ganeti regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3431-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 14, 2016 https://www.debian.org/security/faq -...

Debian DLA-384-1 : inspircd security and regression update

It was discovered that InspIRCd did not validate the names in DNS responses before using them in inter-server communication. A remote attacker controlling the reverse DNS server for an IRC client could use this for denial of service or possibly for privilege escalation on the IRC network. InspIRC...

Debian DLA-378-1 : linux-2.6 security update

This update fixes the CVEs described below. CVE-2015-7550 Dmitry Vyukov discovered a race condition in the keyring subsystem that allows a local user to cause a denial of service crash. CVE-2015-8543 It was discovered that a local user permitted to create raw sockets could cause a denial of servi...

Debian Security Advisory DSA 3434-1 (linux - security update)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak. CVE-2015-7513 It was discovered that a local user permitted to use the x86 KVM subsystem could configure the PIT emulation to cause a denial of service...

[SECURITY] [DLA 374-3] cacti regression update

Package : cacti Version : 0.8.7g-1+squeeze9+deb6u13 CVE ID : CVE-2015-8369 Debian Bug : 807599 It was discovered that there was a regression in the patch intended to fix CVE-2015-8369 in the recent upload of cacti 0.8.7g-1+squeeze9+deb6u12. For Debian 6 Squeeze, this issue has been fixed in cacti...

[SECURITY] [DLA 374-2] cacti regression update

Package : cacti Version : 0.8.7g-1+squeeze9+deb6u12 It was discovered that there was a regression in the patch intended to fix CVE-2015-8369 in the recent upload of cacti 0.8.7g-1+squeeze9+deb6u11. For Debian 6 Squeeze, this issue has been fixed in cacti version 0.8.7g-1+squeeze9+deb6u12. Regards...

Debian DLA-374-3 : cacti regression update

It was discovered that there was a regression in the patch intended to fix CVE-2015-8369 in the recent upload of cacti 0.8.7g-1+squeeze9+deb6u12. For Debian 6 Squeeze, this issue has been fixed in cacti version 0.8.7g-1+squeeze9+deb6u13. NOTE: Tenable Network Security has extracted the preceding...

SUSE-SU-2015:2340-1 Security update for bind

This update fixes the following security issue: - CVE-2015-8000: Fix remote denial of service by misparsing incoming responses bsc958861. It also fixes a bug: - Fix a regression in caching entries with a TTL of 0 bsc923281...

SUSE-SU-2015:2171-1 Security update for gpg2

The gpg2 package was updated to fix the following security and non security issues: - CVE-2015-1606: Fixed invalid memory read using a garbled keyring bsc918089. - CVE-2015-1607: Fixed memcpy with overlapping ranges bsc918090. - bsc955753: Fixed a regression of 'gpg --recv' due to keyserver impor...

openssl security update

1.0.1e-51.1 - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter - fix CVE-2015-3195 - X509ATTRIBUTE memory leak - fix CVE-2015-3196 - race condition when handling PSK identity hint 1.0.1e-51 - fix the CVE-2015-1791 fix broken server side renegotiation 1.0.1e-50 - improved fi...

realmd security, bug fix, and enhancement update

0.16.1-5 - Revert 0.16.1-4 - Use samba by default - Resolves: rhbz1271618 0.16.1-4 - Fix regressions in 0.16.x releases - Resolves: rhbz1258745 - Resolves: rhbz1258488 0.16.1-3 - Fix regression accepting DNS domain names - Resolves: rhbz1243771 0.16.1-2 - Fix discarded patch: ipa-packages.patch...

java-1.6.0-openjdk security update

1:1.6.0.35-1.13.9.4.0.1.el511 - Add oracle-enterprise.patch 1:1.6.0.37-1.13.9.4 - Update with new IcedTea & b37 tarballs, including fix for appletviewer regression. - Resolves: rhbz1271926 1:1.6.0.37-1.13.9.3 - Update with new IcedTea & b37 tarballs, including more Kerberos fixes for TCK...

WAP - Web Application Protection

WAP is a source code static analysis and data mining tool to detect and correct input validation vulnerabilities in web applications written in PHP version 4.0 or higher with a low rate of false positives. WAP detects and corrects the following vulnerabilities: SQL Injection SQLI Cross-site...

Ubuntu 14.04 LTS : unzip regression (USN-2788-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2788-2 advisory. USN-2788-1 fixed vulnerabilities in unzip. One of the security patches caused a regression when extracting 0-byte files. This update fixes the problem. We apologi...