Updated kernel-rt packages fix multiple vulnerabilities

Updated kernel-rt provides upstream 3.10.40 kernel and fixes the following security issues: The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of servi...

MGASA-2014-0227 Updated kernel-rt packages fix multiple vulnerabilities

Updated kernel-rt provides upstream 3.12.20 kernel and fixes the following security issues: The ioapicdeliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvmirqdeliverytoapic return value, which allows guest OS users to cause a denial of service...

Updated kernel-rt packages fix multiple vulnerabilities

Updated kernel-rt provides upstream 3.12.20 kernel and fixes the following security issues: The ioapicdeliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvmirqdeliverytoapic return value, which allows guest OS users to cause a denial of service...

CVE-2014-1807

The ShellExecute API in Windows Shell in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly implement file associations, which allows local...

CVE-2014-1808: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Office 2013 Gold, SP1, RT, and RT SP1 allows remote attackers to obtain sensitive token information via a web site that sends a crafted response during opening of an Office document, aka "Token Reuse Vulnerability."...

PT-2014-1204

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2013 Gold, SP1, RT, and RT SP1 Description The issue is related to the improper handling of a specially crafted response when attempting to open an Office document hosted on a malicious website. This allows an attacke...

Updated kernel-rt packages fixes multiple bugs and vulneraabilities

Updated kernel-rt provides upstream 3.12.18 kernel and fixes the following security issues: Buffer overflow in the completeemulatedmmio function in arch/x86/kvm/ x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that trigge...

Cross site scripting

Cross-site scripting XSS vulnerability in the MobileUI aka RT-Extension-MobileUI extension before 1.04 in Request Tracker RT 4.0.0 before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the name of an attached file...

CVE-2013-3736

CVE-2013-3736 is an XSS in MobileUI (RT-Extension-MobileUI) for Request Tracker (RT) 4.0.0 before 4.0.13 and MobileUI before 1.04. The flaw allows remote attackers to inject arbitrary web script or HTML via the name of an attached file. Affected components: MobileUI/RT-Extension-MobileUI; affecte...

PT-2014-2708

Name of the Vulnerable Software and Affected Versions Request Tracker versions 4.0.0 through 4.0.12 RT-Extension-MobileUI extension version prior to 1.04 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the name of an attached file...

CVE-2014-2925

Cross-site scripting XSS vulnerability in AdvancedWirelessContent.asp in ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote attackers to inject arbitrary web script or HTML via the currentpage parameter to apply.cgi...

Code injection

The Network Analysis tab MainAnalysisContent.asp in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the Target field destIP parameter...

Code injection

AdvancedSystemContent.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code...

Cross site scripting

Cross-site scripting XSS vulnerability in AdvancedWirelessContent.asp in ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote attackers to inject arbitrary web script or HTML via the currentpage parameter to apply.cgi...

CVE-2014-2925

Cross-site scripting XSS vulnerability in AdvancedWirelessContent.asp in ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote attackers to inject arbitrary web script or HTML via the currentpage parameter to apply.cgi...

CVE-2013-5948

The Network Analysis tab MainAnalysisContent.asp in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the Target field destIP parameter...

CVE-2013-5948

CVE-2013-5948 documents concrete details: Affected devices are ASUS RT-AC68U and other RT-series routers with firmware before 3.0.0.4.374.5047. The issue resides in the Network Analysis tab (Main_Analysis_Content.asp), where remote authenticated users can cause arbitrary commands to run via shell...

CVE-2014-2719

The CVE affects ASUS RT series routers with firmware prior to 3.0.0.4.374.5517. The vulnerability arises in Advanced_System_Content.asp: when an administrator session is active, remote authenticated users can read the page source to obtain the administrator username and password. Impact is creden...

PT-2014-4884

Name of the Vulnerable Software and Affected Versions ASUS RT series routers versions prior to 3.0.0.4.374.5517 Description The issue allows remote authenticated users to obtain the administrator user name and password by reading the source code of the Advanced System Content.asp page when an...

PT-2014-4959

Name of the Vulnerable Software and Affected Versions ASUS RT-AC68U and other RT series routers versions prior to 3.0.0.4.374.5047 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the current page parameter to "apply.cgi"...