[SECURITY] Fedora 24 Update: nodejs-ws-1.1.1-1.fc24

Simple to use, blazing fast and thoroughly tested web socket client, server and console for nodejs, up-to-date against RFC-6455...

[SECURITY] Fedora 23 Update: nodejs-ws-1.1.1-1.fc23

Simple to use, blazing fast and thoroughly tested web socket client, server and console for nodejs, up-to-date against RFC-6455...

OracleVM 3.2 : sudo (OVMSA-2016-0079)

The remote OracleVM system is missing necessary patches to address critical security updates : - added patch for CVE-2014-0106: certain environment variables not sanitized when envreset is disabled Resolves: rhbz1072210 - backported fixes for CVE-2013-1775 CVE-2013-1776 CVE-2013-2776 CVE-2013-277...

SOL64505405 - NTP vulnerability CVE-2016-4956

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

[SECURITY] Fedora 23 Update: openslp-2.0.0-8.fc23

Service Location Protocol is an IETF standards track protocol that provides a framework to allow networking applications to discover the existence, location, and configuration of networked services in enterprise networks. OpenSLP is an open source implementation of the SLPv2 protocol as defined b...

CVE-2013-7440

The ssl.matchhostname function in CPython aka Python before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate...

[SECURITY] Fedora 24 Update: openslp-2.0.0-9.fc24

Service Location Protocol is an IETF standards track protocol that provides a framework to allow networking applications to discover the existence, location, and configuration of networked services in enterprise networks. OpenSLP is an open source implementation of the SLPv2 protocol as defined b...

[SECURITY] Fedora 23 Update: pgpdump-0.31-1.fc23

pgpdump is a PGP packet visualizer which displays the packet format of OpenPGP RFC 4880 and PGP version 2 RFC 1991...

[SECURITY] Fedora 22 Update: pgpdump-0.31-1.fc22

pgpdump is a PGP packet visualizer which displays the packet format of OpenPGP RFC 4880 and PGP version 2 RFC 1991...

[SECURITY] Fedora 24 Update: pgpdump-0.31-1.fc24

pgpdump is a PGP packet visualizer which displays the packet format of OpenPGP RFC 4880 and PGP version 2 RFC 1991...

Ruby: SMTP command injection

Net::SMTP is vulnerable to RCPT TO/MAIL FROM injection due to lack of input validation and conformance to the SMTP protocol. Publicly disclosed already: http://www.mbsd.jp/Whitepaper/smtpi.pdf People are wrongly assigning this to the mail gem http://rubysec.com/advisories/OSVDB-131677/ and thinki...

[SECURITY] Fedora 23 Update: pgpdump-0.30-1.fc23

pgpdump is a PGP packet visualizer which displays the packet format of OpenPGP RFC 4880 and PGP version 2 RFC 1991...

[SECURITY] Fedora 22 Update: pgpdump-0.30-1.fc22

pgpdump is a PGP packet visualizer which displays the packet format of OpenPGP RFC 4880 and PGP version 2 RFC 1991...

CVE-2016-4554

An input validation flaw was found in Squid's mimegetheaderfield function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid...

[SECURITY] Fedora 24 Update: pgpdump-0.30-1.fc24

pgpdump is a PGP packet visualizer which displays the packet format of OpenPGP RFC 4880 and PGP version 2 RFC 1991...

CVE-2016-2427

The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug...

Design/Logic Flaw

The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug...

CVE-2016-2427

The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug...

CVE-2016-2427

The CVE-2016-2427 entry concerns AES-GCM-ICVlen = 12 octets in the AES-GCM implementation used by Android 5.x–6.x. The NVD description cites a potential weakness that could defeat cryptographic protection and reveal an authentication key via a crafted app. However, Android’s vendor notes state th...

RHEL 6 : kernel (RHSA-2016:0617)

An update for kernel is now available for Red Hat Enterprise Linux 6.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...