CVE-2016-4450 Nginx Vulnerabilities | Cloud Foundry

CVE-2016-4450 Nginx Vulnerabilities Medium Vendor nginx, Cloud Foundry Versions Affected nginx before 1.10.1 and 1.11.x versions before 1.11.1 Cloud Foundry staticfile buildpack prior to version 1.3.9 Cloud Foundry cf-release prior to version 238 Description os/unix/ngxfiles.c in nginx before...

PrinceXML Wrapper Class Command Injection

While grabbing a copy PrinceXML, I noticed the company also offered some wrapper classes in various languages for using prince in server applications web applications. http://www.princexml.com/download/wrappers/ Taking a quick look at the PHP class, there are likely numerous command injection...

Debian DLA-543-1 : sqlite3 security update

It was discovered that sqlite3, a C library that implements a SQL database engine, would reject a temporary directory e.g., as specified by the TMPDIR environment variable to which the executing user did not have read permissions. This could result in information leakage as less secure global...

The vulnerability of the Firefox browser allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the maintenanceinstaller.exe installer for Mozilla Firefox allows local users to elevate their privileges by placing a Trojan DLL file in the temporary folder during the update process...

SQLite Information Disclosure Vulnerability

SQLite is an open source C-based embedded relational database management system developed by American software developer D. Richard Hipp. The system is characterized by independence, isolation, cross-platform and so on. SQLite 3.13.0 before the version of a security vulnerability , the...

The vulnerability of the Linux operating system allows a malicious individual to gain access to protected information or cause service failures.

When processing temporary IPv6 addresses, an error occurs. As a result, users from the same local network may experience service failure or access protected information by sending messages to the router that disable the creation of temporary addresses...

The vulnerability of the Java Development Kit application development tool allows a local user to replace any files they choose.

A vulnerability in the Java Development Kit application development tool, related to errors in the unpack::redirectstdio function in unpack.cpp within unpack200 in OpenJDK, Oracle Java SE, JRockit, and Java SE Embedded, arises due to the insecure creation of temporary files when it is impossible ...

SQLite Tempdir Selection

KL-001-2016-003 : SQLite Tempdir Selection Vulnerability Title: SQLite Tempdir Selection Vulnerability Advisory ID: KL-001-2016-003 Publication Date: 2016.07.01 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt 1. Vulnerability Details Affected Vendor: SQLite/Hwa...

SQLite Tempdir Selection Vulnerability

Vulnerability Details Affected Vendor: SQLite/Hwaci Affected Product: SQLite Affected Version: All versions prior to 3.13.0 Platform: UNIX, GNU/Linux CWE Classification: CWE-379: Creation of Temporary File in Directory with Incorrect Permissions Impact: Data Leakage Attack vector: Local 2...

[SECURITY] Fedora 23 Update: xguest-1.0.10-33.fc23

Installing this package sets up the xguest user to be used as a temporary account to switch to or as a kiosk user account. The account is disabled un less SELinux is in enforcing mode. The user is only allowed to log in via graphi cal login program. The home and temporary directories of the user...

[SECURITY] Fedora 24 Update: xguest-1.0.10-34.fc24

Installing this package sets up the xguest user to be used as a temporary account to switch to or as a kiosk user account. The account is disabled un less SELinux is in enforcing mode. The user is only allowed to log in via graphi cal login program. The home and temporary directories of the user...

Enonic XP: source code security analysis report

Several vulnerabilities were discovered in Enonic AS 'Enonic XP' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Отсутствие верификации цифровой подписи исполняемых файлов, полученных из недоверенных источников HttpOnly...

Nuclear, Angler Exploit Kit Activity Has Disappeared

Criminal hackers are fickle about their attack vectors. You need to look no further for evidence of this than their constant migration from one exploit kit to another. And while there is an expansive menu of exploit kits, attackers do seem to congregate around a precious few. Researchers who stud...

OracleVM 3.2 : sos (OVMSA-2016-0078)

The remote OracleVM system is missing necessary patches to address critical security updates : - add patch to remove all sysrq echo commands from sysreport.legacy John Sobecki orabug 11061754 - comment out rh-upload-core and README.rh-upload-core in specfile - Strip passwords from grub.conf and...

The vulnerability of the PHP interpreter, which allows a hacker to trigger a service failure

The vulnerability in the main/phpopentemporaryfile.c function of the PHP interpreter arises due to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service interruptions such as outages and memory corruption...

CVE-2016-4450

os/unix/ngxfiles.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service NULL pointer dereference and worker process crash via a crafted request, involving writing a client request body to a temporary file...

DEBIAN-CVE-2016-4450

os/unix/ngxfiles.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service NULL pointer dereference and worker process crash via a crafted request, involving writing a client request body to a temporary file...

CVE-2016-4450

os/unix/ngxfiles.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service NULL pointer dereference and worker process crash via a crafted request, involving writing a client request body to a temporary file...

DEBIAN-CVE-2016-3096

The createscript function in the lxccontainer module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on 1 /opt/.lxc-attach-script, 2 the archived container in the archivepath directory, or the 3...

PYSEC-2016-1

The createscript function in the lxccontainer module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on 1 /opt/.lxc-attach-script, 2 the archived container in the archivepath directory, or the 3...