nginx fix for malformed HTTP responses from upstream servers

Hello, The nginx team has released stable version 1.0.14, and development version 1.1.17 of nginx web server, which include a fix for malformed HTTP responses from upstream servers: http://trac.nginx.org/nginx/changeset/4535/nginx http://trac.nginx.org/nginx/changeset/4531/nginx...

SuSE 10 Security Update : Apache2 (ZYPP Patch Number 7972)

This update of apache fixes regressions and several security problems : - Fixed a scoreboard corruption shared mem segment by child causes crash of privileged parent invalid free during shutdown. bnc741243, CVE-2012-0031 - Fixed an issue in error responses that could expose 'httpOnly' cookies whe...

apache2: fixed various security bugs (important)

This update of apache2 fixes regressions and several security problems: bnc728876, fix graceful reload bnc741243, CVE-2012-0031: Fixed a scoreboard corruption shared mem segment by child causes crash of privileged parent invalid free during shutdown. bnc743743, CVE-2012-0053: Fixed an issue in...

GLSA-201202-04 : PowerDNS: Denial of Service

The remote host is affected by the vulnerability described in GLSA-201202-04 PowerDNS: Denial of Service A vulnerability has been found in PowerDNS which could cause a packet loop of DNS responses. Impact : A remote attacker could send specially crafted DNS response packets, possibly resulting in...

Debian Security Advisory DSA 2381-1 (squid3)

The remote host is missing an update to squid3 announced via advisory DSA 2381-1. OpenVAS Vulnerability Test $Id: deb23811.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2381-1 squid3 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Wireless Penetration Testing Series Part 2: Basic concepts of WLANs

Wireless Penetration Testing Series Part 2: Basic concepts of WLANs This blog post is in continuation of the Wireless Penetration Testing and Hacking series we started Part 1: Getting Started with Monitoring and Injection on the basis of the "SecurityTube Wi-Fi Security Expert" SWSE course which ...

Apache Httpd < 2.0.65 : error responses can expose cookies

A flaw was found in the default error response for status code 400. This flaw could be used by an attacker to expose "httpOnly" cookies when no custom ErrorDocument is specified...

Debian DSA-2381-1 : squid3 - invalid memory deallocation

It was discovered that the IPv6 support code in Squid does not properly handle certain DNS responses, resulting in deallocation of an invalid pointer and a daemon crash. The squid package and the version of Squid 3 shipped in lenny lack IPv6 support and are not affected by this issue. %NASLMINLEV...

PT-2012-1018

Name of the Vulnerable Software and Affected Versions PowerDNS pdns Authoritative Server versions prior to 2.9.22.5 PowerDNS pdns Authoritative Server versions 3.x prior to 3.0.1 Description The issue allows remote attackers to cause a denial of service, specifically a packet loop, via crafted UD...

CoCSoft Stream Down Stack Overflow

Added: 01/10/2012 CVE: CVE-2011-5052 BID: 51190 OSVDB: 78043 Background CoCSoft Stream Down is a streaming media download tool. Problem The CoCSoft Stream Down HTTP client implementation in version 6.8 and prior does not properly validate HTTP responses. This vulnerability may allow an attacker t...

DSA-2381-1 squid3 - invalid memory deallocation

Bulletin has no description...

Fedora 15 : squid-3.1.16-1.fc15 (2011-15233)

Upstream bugfix update fixing invalid free on certain DNS responses Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 14 : squid-3.1.16-1.fc14 (2011-15256)

Upstream bugfix release fixing invalid free on certain DNS responses Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Microsoft Windows DNS Insufficient Socket Entropy (MS08-037; CVE-2008-1447)

There exists a DNS Cache Poisoning vulnerability in Microsoft DNS servers and clients. A remote attacker can exploit this vulnerability to poison the DNS cache by sending malicious responses to DNS requests, thereby redirecting Internet traffic to illegitimate sites. In a successful attack case,...

PYSEC-2011-2

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service resource consumption via a URL associated with...

PT-2011-4855

Name of the Vulnerable Software and Affected Versions Django versions prior to 1.2.7 Django versions 1.3.x prior to 1.3.1 Description The issue is related to the verify exists functionality in the URLField implementation, which relies on Python libraries that attempt to access an arbitrary URL wi...

PT-2011-2857 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.38 Description: The issue allows remote DNS servers to cause a denial of service by not providing a valid response to a DNS query. This can trigger improper handling of error data within a DNS resolver key,...

Pidgin Libpurple Protocol Plugins Denial of Service Vulnerabilities (Windows)

This host is installed with Pidgin and is prone to denial of service vulnerabilities. OpenVAS Vulnerability Test $Id: gbpidginlibpurpleprotocolpluginsdosvulnwin.nasl 7024 2017-08-30 11:51:43Z teissa $ Pidgin Libpurple Protocol Plugins Denial of Service Vulnerabilities Windows Authors: Rachana...

Mandriva Linux Security Advisory : pidgin (MDVSA-2011:132-1)

Multiple vulnerabilities has been identified and fixed in pidgin : It was found that the gdk-pixbuf GIF image loader routine gdkpixbufgifimageload did not properly handle certain return values from its subroutines. A remote attacker could provide a specially crafted GIF image, which, once opened ...

PT-2011-4296

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.10.0 Description The issue is related to the msn httpconn parse data function in the MSN protocol plugin, which does not properly handle HTTP 100 responses. This allows remote attackers to cause a denial of service,...