DLA-250-1 libclamunrar - security update

Bulletin has no description...

Mozilla Moving Toward Full HTTPS Enforcement in Firefox

The Mozilla Foundation is initiating the process to phase out insecure HTTP connections in the Firefox browser. The decision is part of a broader movement to encrypt the Web, which in the case of Mozilla Firefox, means permitting only encrypted HTTPS browser connections. Mozilla is the developer ...

'Yes, Your Car Wash is On Facebook'

CANCUN–When or if people think about the security of the devices they interact with and use on a daily basis, the machines that run their local car wash probably aren’t high up on that list. But, like everything else with a computer for a brain these days, those machines are connected to the...

HackerOne: Markdown code block sequence makes report unreadable

Proof of Concept Submitting a report/comment with an input like the following "Three backticks followed by a newline followed by -ddd/d" will cause the report to be unreadable I think it's because the parser is crashing? The attached file includes the input that I'm trying with difficulty to...

CVE-2 0 1 4-1 8 0 6 . NET Remoting Services vulnerability analysis-vulnerability warning-the black bar safety net

0x00 description Microsoft . NET Remoting is a distributed processing manner, there is provided a method that allows the object by the application domain with the other objects to interact with the framework. A few days ago James Forshaw posted a CVE-2 0 1 4-1 8 0 6 . NET Remoting Services exploi...

Dennis Fisher and Mike Mimoso Discuss This Week's Microsoft Takedown

Dennis Fisher and Mike Mimoso discuss the Microsoft malware takedown, its legal and security implications and the revelation of a massive financial fraud campaign in Brazil. Download: digitalunderground157.mp3 Music by Chris Gonsalves...

PHP Director <= 0.21 Remote Command Execution Exploit

No description provided by source. --+++===================================================================+++-- --+++====== PHP Director = 0.21 Remote Command Execution Exploit ======+++-- --+++===================================================================+++-- !/usr/bin/perl use strict; us...

SGI IRIX <= 6.5.2 nsd Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/412/info A vulnerability has been discovered in the nsd service, as included by SGI in Irix 6.5.x. The vulnerability allows remote users to access potentially sensitive pieces of information, including, but not limited to...

[oss-security] libgadu vulnerability: possible memory corruption

I'd like to request a CVE ID for the following issue: A crafted message from the file relay server may cause memory to beoverwritten. The memory is not overwritten with data sent directly by the server, but security implications cannot be ruled out. The bug is public:...

Security advisory, LedgerSMB 1.3.0-1.3.36

Security Advisory: LedgerSMB 1.3.36, Improper Logout on Some Browsers Severity: Low cvssv2 base score: 3.6, total 0.5 Remotely Exploitable: No Complexity of Attack: High Impact: Relatively low. Prerequisite for Attack: Physical Access to Previously Logged In Browser, so high complexity in most...

MGASA-2014-0036 Updated Firefox & Thunderbird packages fix multiple security vulnerabilities

Updated firefox and thunderbird packages fix security vulnerabilities: Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox or Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user...

Some Versions of Ruby on Rails Could Expose Cookies

Versions 2.0 to 4.0 of the popular open source Web framework Ruby on Rails are vulnerable to a Web security issue involving cookies that could make it much easier for someone to log in to an app as another user. According to security researcher G.S. McNamara, Ruby on Rails’ defacto session storin...

Having fun with

Did you know that this works in every browser? Look, here's one: An image You might think it's leaking from SVG, but SVG images don't use src, they use xlink:href. Let's all take a moment to laugh at xlink. Done? Ok… In the first age of the web, some people accidentally typed instead of . Browser...

[Topera] The IPv6 port scanner invisible to Snort (IDS)

Topera is a brand new TCP port scanner under IPv6 , with the particularity that these scans are not detected by Snort. Snort is the most known IDS/IPS and is widely used in many different critical environments. Some commercial tools Juniper or Checkpoint ones use it as detection engine also...

SuSE Update for update openSUSE-SU-2012:1620-1 (update)

Check for the Version of update OpenVAS Vulnerability Test $Id: gbsuse201216201.nasl 8456 2018-01-18 06:58:40Z teissa $ SuSE Update for update openSUSE-SU-2012:1620-1 update Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program ...

Scientific Linux Security Update : rpm on SL4.x i386/x86_64

It was discovered that RPM did not remove setuid and setgid bits set on binaries when upgrading or removing packages. A local attacker able to create hard links to binaries could use this flaw to keep those binaries on the system, at a specific version level and with the setuid or setgid bit set,...

Fedora 16 : boost-1.47.0-7.fc16 (2012-9029)

This update fixes a bug in Boost.Pool, which could under certain circumstances overflow allocated chunk size. This could have security implications for applications that use Boost pool without sanitizing pool parameters. - Add a sub-package boost-math with math-related bits from Boost.TR1. This...

Fedora 17 : boost-1.48.0-13.fc17 (2012-9818)

This update fixes a bug in Boost.Pool, which could under certain circumstances overflow allocated chunk size. This could have security implications for applications that use Boost pool without sanitizing pool parameters. - Boost.Locale library now contains backend code, which was left out before...

Common Firewall Feature Enables TCP Hijacking Attacks

Attackers using a feature that is common to many firewalls, switches and other networking gear could silently hijack Web sessions on mobile and desktop devices, according to a research paper presented by two Ph.D students from the University of Michigan. The two discovered that so-called TCP...

Generation Y Won't Listen To IT

The latest generation of desk-jockey’s admitted in a recent CISCO study that they frequently ignore and/or circumvent the information technology IT policies of their employers, heightening corporate risk. The CISCO Connected World Technology Report surveyed some 2,800 college students and young...