CVE-2016-10003

Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients...

Scientific Linux Security Update : squid on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: squid 3.5.20. Security Fixes : - Incorrect boundary checks were found in the way squid handled headers in HTTP responses, which could lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid usi...

CVE-2016-7429

A flaw was found in the way ntpd running on a host with multiple network interfaces handled certain server responses. A remote attacker could use this flaw which would cause ntpd to not synchronize with the source. Mitigation If you are going to configure your OS to disable source address checks,...

Squid 3.5.x < 3.5.15 Multiple Vulnerabilities

Binary data 9774.prm...

Microsoft Edge Spoofing Vulnerability (CNVD-2016-10948)

Microsoft Edge is a Web browser developed by the American company Microsoft Microsoft. Microsoft Edge has a spoofing vulnerability due to the program failing to properly analyze HTTP responses. An attacker exploits the vulnerability to trick users into visiting a constructed website...

squid: some code paths fail to check bounds in string object

Incorrect boundary checks were found in the way squid handled headers in HTTP responses, which could lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response...

squid: wrong error handling for malformed HTTP responses

It was found that squid did not properly handle errors when failing to parse an HTTP response, possibly leading to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response...

squid: wrong error handling for malformed HTTP responses

It was found that squid did not properly handle errors when failing to parse an HTTP response, possibly leading to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response...

Information modification vulnerability in multiple Samsung Galaxy devices

The Samsung Galaxy S4 and others are smart mobile devices released by the South Korean company Samsung Samsung. The information modification vulnerability exists in Samsung Galaxy S4 to S7 devices and stems from the program's failure to validate BroadcastReceiver responses. An attacker could...

IBM WebSphere Application Server 7.0 < 7.0.0.33 Multiple Vulnerabilities

Binary data 9699.prm...

CVE-2016-6380

The DNS forwarder in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.15 allows remote attackers to obtain sensitive information from process memory or cause a denial of service data corruption or device reload via a crafted DNS response, aka Bug ID CSCup90532...

CVE-2016-5986

IBM WebSphere Application Server WAS 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, 8.5.x before 8.5.5.11, 9.0.x before 9.0.0.2, and Liberty before 16.0.0.3 mishandles responses, which allows remote attackers to obtain sensitive information via unspecified vectors...

Updated gnutls packages fix security vulnerability

An issue was found in certificate validation using OCSP responses caused by not verifying the serial length, which can falsely report a certificate as valid CVE-2016-7444...

MGASA-2016-0326 Updated gnutls packages fix security vulnerability

An issue was found in certificate validation using OCSP responses caused by not verifying the serial length, which can falsely report a certificate as valid CVE-2016-7444...

UBUNTU-CVE-2016-6172

PowerDNS aka pdns Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service memory exhaustion and secondary DNS server crash via a large 1 AXFR or 2 IXFR response...

MGASA-2016-0320 Applications using libtorrent-rasterbar are vulnerable to denial of service

Applications using libtorrent-rasterbar are vulnerable to denial of service. An attacker-controlled torrent tracker can crash victim torrent clients by sending malformed GZIP responses CVE-2016-7164...

CVE-2016-7444

A flaw was found in the way GnuTLS validated certificates using OCSP responses. This could falsely report a certificate as valid under certain circumstances...

libtorrent-rasterbar: denial of service

A bug has been found in the libtorrent-rasterbar code handling GZIP-encoded responses from a tracker, where malformed responses could lead to a crash...

OLX: Bypassing Phone Verification For Posting AD On OLX

Overview In computer networks, rate limiting is used to control the rate of traffic sent or received by a network interface controller. It can be induced by the network protocol stack of the sender due to a received ECN-marked packet and also by the network scheduler of any router along the way...

Remote Denial of Service Vulnerability in Multiple F5 BIG-IP Products (CNVD-2016-07035)

F5 BIG-IP is an all-in-one network device from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A remote denial of service vulnerability exists in multiple F5 BIG-IP products, which can be exploited by an attacker to cause a...