8759 matches found
Do not release details about securrity vulnerabilities until after the fix was available for a reasonable period of time
It is an unfortunate practice at Atlassian to as a part of release notes release all the information, often including example exploits|http://jira.atlassian.com/browse/CONF-9350, about security vulnerabilities that were fixed in the version being released. This gives us great headaches because: w...
Fedora 8 : xine-lib-1.1.10.1-1.fc8 (2008-1543)
Fri Feb 8 2008 Ville Skytta - 1.1.10.1-1 - 1.1.10.1 security update, 431541. Sun Jan 27 2008 Ville Skytta - 1.1.10-2 - Include spu, spucc, and spucmml decoders 213597. Upstream release notes: http://sourceforge.net/project/shownotes.php?groupid=96 55&releaseid=574735 Note that Tenable Network...
[slackware-security] mysql
New mysql packages are available for Slackware 11.0, 12.0, and -current to fix bugs and security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2007-3781 https://vulners.com/cve/CVE-2007-5925...
Moderate: Red Hat Security Advisory: JBoss Enterprise Application Platform security update
Updated JBoss Enterprise Application Platform packages that fix several security issues and bugs are now available for Red Hat Application Stack v1 and v2. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The updated packages address the followi...
Common UNIX Printing System IPP Tags Memory Corruption Vulnerability
The Common UNIX Printing System CUPS versions 1.3.3 and prior contain a vulnerability that can allow an unauthenticated, remote attacker to create a denial of service DoS condition or execute arbitrary code with the privileges of the user. The vulnerability exists in the ippReadIO function when...
SOL4743 - Inadequate validation for TCP segments CVE-2005-0356
Multiple TCP implementations with Protection Against Wrapped Sequence Numbers PAWS with the timestamps option enabled allow remote attackers to cause a denial of service connection loss via a spoofed packet with a large timer value, which causes the host to discard later packets because they appe...
SOL6920 - Cross-site scripting vulnerabilities
Multiple cross-site scripting XSS vulnerabilities exist in the FirePass Administrative Console pages. The affected FirePass URLs fail to fully sanitize certain URL arguments before the requested web page content is returned to the browser. It is possible for an attacker to create web pages, email...
SOL6592 - Cross-Site Scripting vulnerability in the logon page
A cross-site scripting XSS vulnerability exists in the FirePass logon page. The affected FirePass logout URL fails to fully sanitize URL input before the web page content is sent to the browser. It is possible for an attacker to create web pages or emails with URLs that include executable code or...
trac -- reStructuredText breach of privacy and denial of service vulnerability
The Trac 0.9.6 Release Notes reports: Fixed reStructuredText breach of privacy and denial of service vulnerability found by Felix Wiemann. The discovered vulnerability requires docutils to be installed and enabled. Systems that do not have docutils installed or enabled are not vulnerable. As of...
SOL5725 - pam_ldap password policy control vulnerability CAN-2005-2641
The pamldap authentication module may allow clients to authenticate with lower security ciphers than are normally required when the clients have been referred from another LDAP server. F5 Product Development tracked this issue as CR54024 and it was fixed in BIG-IP LTM 9.1.3 for the 9.1 software...
Cacti Local File Inclusion Vulnerability
The Cacti application running on the remote web server is affected by a local file inclusion vulnerability due to improperly validating user-supplied input to the 'configincludepath' parameter in 'configsettings.php'. A remote attacker can exploit this to execute arbitrary PHP code. %NASLMINLEVEL...
Mercury Mail 4.01 (Pegasus) IMAP Buffer Overflow v2 (c code)
No description provided by source. / Remote Mercury32 Imap exploit 14 types of attacks WOW! By: [email protected] Notes: Second public release and both of them are murcury32 ; Again someone posted some dos code : why bother? If you spent the time to look, it uses the same buffer for all 14 type...
sendmail 8.12.8 available
-----BEGIN PGP SIGNED MESSAGE----- Sendmail, Inc., and the Sendmail Consortium announce the availability of sendmail 8.12.8. It contains a fix for a critical security problem discovered by Mark Dowd of ISS X-Force; we thank ISS X-Force for bringing this problem to our attention. Sendmail urges al...
mailman XSS in user options page
From the 2.1.1 release notes: Closed a cross-site scripting vulnerability in the user options page...
VS 2008 - VS - PRO - RUS.SP0
...
Windows1122H2ComponentDuRTM
Windows1122H2ComponentDuRTM...
.NET 5.0 Update
None None...
Visual Studio 2022 Security Update (17.14.36)
This security update applies to all editions of Visual Studio 2022, and will update client machines on the Current channel to version 17.14.36. The client machines must be enabled to receive this administrator update, and by default Visual Studio must be closed on the client in order for the upda...