Security update for java-1_7_0-openjdk (important)

This update for java-170-openjdk to version 2.6.6 fixes five security issues. These security issues were fixed: - CVE-2016-0686: Ensure thread consistency bsc976340. - CVE-2016-0687: Better byte behavior bsc976340. - CVE-2016-0695: Make DSA more fair bsc976340. - CVE-2016-3425: Better buffering o...

Vulnerability in OpenSSL - EBCDIC overread

ASN1 Strings that are over 1024 bytes can cause an overread in applications using the X509NAMEoneline function on EBCDIC systems. This could result in arbitrary stack data being returned in the buffer...

Wireshark NCP Parser Stack Buffer Overflow Vulnerability

Wireshark formerly known as Ethereal is a suite of network packet analysis software developed by the Wireshark team. A stack buffer overflow vulnerability exists in the epan/dissectors/packet-ncp2222.inc file in the NCP parser in Wireshark versions 1.12.11 prior to 1.12.x. This vulnerability can ...

DEBIAN-CVE-2016-4085

Stack-based buffer overflow in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.12.x before 1.12.11 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a long string in a packet...

[SECURITY] Fedora 24 Update: binutils-2.26-18.fc24

Binutils is a collection of binary utilities, including ar for creating, modifying and extracting from archives, as a family of GNU assemblers, gprof for displaying call graph profile data, ld the GNU linker, nm for listing symbols from object files, objcopy for copying and translating object...

festivaltts4r Gem for Ruby Arbitrary Command Execution

festivaltts4r passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to the tospeech and and tomp3 methods in lib/festivaltts4r/festival4r.rb library...

PT-2017-7489

Name of the Vulnerable Software and Affected Versions semver versions prior to 4.3.2 Description The issue allows attackers to cause a denial of service, specifically CPU consumption, via a long version string. This is referred to as a regular expression denial of service ReDoS. The vulnerability...

Strings Ensemble Effect Plugin - Exported components vulnerabilities

HackApp vulnerability scanner discovered that application Strings Ensemble Effect Plugin published at the 'play' market has multiple vulnerabilities...

UBUNTU-CVE-2014-9769

pcrejitcompile.c in PCRE 8.35 does not properly use table jumps to optimize nested alternatives, which allows remote attackers to cause a denial of service stack memory corruption or possibly have unspecified other impact via a crafted string, as demonstrated by packets encountered by Suricata...

DEBIAN-CVE-2014-9769

pcrejitcompile.c in PCRE 8.35 does not properly use table jumps to optimize nested alternatives, which allows remote attackers to cause a denial of service stack memory corruption or possibly have unspecified other impact via a crafted string, as demonstrated by packets encountered by Suricata...

USN-2938-1: Git vulnerabilities

Laël Cellier discovered that Git incorrectly handled path strings in crafted Git repositories. A remote attacker could use this issue to cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking Git. CVE-2016-2315, CVE-2016-2324...

OpenSSL DoS

The vulnerability of the doaproutch function in the OpenSSL library arises due to buffer overflow. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures or other effects by sending a long ASN.1 string...

Putty pscp 0.66 - Stack Buffer Overwrite

Exploit for multiple platform in category dos / poc Source: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563 Author: Date: Feb 20th, 2016 Name: putty Vendor: sgtatham - http://www.chiark.greenend.org.uk/sgtatham/putty/ Version: 0.59 3 9 years ago = affected = 0.66 Platforms: win/ni...

Out-of-bounds read in HTML parser following a failed allocation — Mozilla

Security researcher Ronald Crane reported an out-of-bounds read following a failed allocation in the HTML parser while working with unicode strings. This can also affect the parsing of XML and SVG format data. This leads to a potentially exploitable crash...

UBUNTU-CVE-2016-0797

Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service heap memory corruption or NULL pointer dereference or possibly have unspecified other impact via a long digit string that is mishandled by the 1 BNdec2bn or 2...

Vulnerability in OpenSSL - Fix memory issues in BIO_*printf functions

The internal |fmtstr| function used in processing a “%s” format string in the BIOprintf functions could overflow while calculating the length of a string and cause an OOB read when printing very long strings. Additionally the internal |doaproutch| function can attempt to write to an OOB memory...

Analyzing Linux Malware Sandbox: Limon

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect the Linux malware before execution, during execution, and after execution post-mortem analysis by...

PHP interpreter vulnerabilities service failures adverse effects

The multiple vulnerabilities of the phpescapeshellcmd or phpescapeshellarg functions ext/standard/exec.c in the PHP interpreter are caused by a numerical overflow. Exploitation of these vulnerabilities could allow a malicious actor to cause service failures or potentially have other effects by...

PT-2017-5760

Name of the Vulnerable Software and Affected Versions: validator versions prior to 1.1.0 Description: The issue allows remote attackers to bypass the cross-site scripting XSS filter via nested forbidden strings. Several cross-site scripting vulnerabilities are present due to bypasses discovered i...

Debian DLA-408-1 : gosa security update

GOsa is a combination of system-administrator and end-user web interface, designed to handle LDAP based setups. GOsa upstream reported a code injection vulnerability in the Samba plugin code of GOsa. During Samba password changes it has been possible to inject malicious Perl code. This upload to...