[SECURITY] Fedora 19 Update: mediawiki-1.23.5-1.fc19

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

libXv: Array Index error leading to heap-based OOB write

Buffer overflow in X.org libXv 1.0.7 and earlier allows X servers to cause a denial of service crash and possibly execute arbitrary code via crafted length or index values to the XvQueryPortAttributes function...

libXi: Multiple integer overflows leading to heap-based buffer-overflows

Multiple integer overflows in X.org libXi 1.7.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XGetDeviceControl, 2 XGetFeedbackControl, 3 XGetDeviceDontPropagateList, 4 XGetDeviceMotionEvents, 5 XIGetProperty, 6...

libXcursor: Integer overflow leading to heap-based buffer overflow

Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XcursorFileHeaderCreate function...

libXrandr: Multiple integer overflows leading to heap-based bufer overflows

Multiple integer overflows in X.org libXrandr 1.4.0 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XRRQueryOutputProperty and 2 XRRQueryProviderProperty functions...

Amazon Linux AMI : jakarta-commons-httpclient (ALAS-2014-410)

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle...

Amazon Linux AMI : libXfont (ALAS-2014-404)

Multiple integer overflows in the 1 fsgetreply, 2 fsallocglyphs, and 3 fsreadextentinfo functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow. Multiple buffer overflows in...

Design/Logic Flaw

The Sketch W Friends FREE -Tablets aka air.com.xlabz.SketchWFriendsFree application 5.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6887

The EXPRESS aka com.gpshopper.express.android application 2.5.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

[SECURITY] Fedora 20 Update: openstack-neutron-2013.2.4-4.fc20

Neutron is a virtual network service for Openstack. Just like OpenStack Nova provides an API to dynamically request and configure virtual servers, Neutron provides an API to dynamically request and configure virtual networks. These networks connect "interfaces" from other OpenStack services e.g.,...

CVE-2013-4488

libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers...

Code injection

libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers...

CVE-2013-4488

libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers...

CVE-2013-4488

libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers...

Microsoft Exchange IIS HTTP Internal IP Address Disclosure

No description provided by source. Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability Google Dork: NA Date: 08/01/2014 Exploit Author: Nate Power Vendor Homepage: microsoft.com Software Link: NA Version: Exchange OWA 2003, Exchange CAS 2007/2010/2013 Tested on: Exchan...

F5 Networks BIG-IP : HTTP cookie vulnerability (SOL15406)

The built-in web servers for multiple networking devices do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the same server. CVE-2004-0462 C Tenable Network Security, Inc. The...

Rejetto HTTP File Server (HFS) - Remote Command Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Rejetto HttpFileServer Remote Command Execution", 'Description' = %q Rejetto HttpFileServer HFS is vulnerable to remote command...

[SECURITY] Fedora 21 Update: phpMyAdmin-4.2.9.1-1.fc21

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

CVE-2014-7275

Removed by vendor...

CVE-2014-7273

CVE-2014-7273 affects getmail up to version 4.43.0, where IMAP-over-SSL does not verify X.509 certificates, enabling MITM attacks and potential disclosure of sensitive data. Remediation: upgrade to getmail 4.46.0 (or newer, e.g., 4.46.0-1/4.46.0-1~deb6u1 per Debian) where the issue is fixed. Rela...