[USN-2131-1] IcedTea Web vulnerability

========================================================================== Ubuntu Security Notice USN-2131-1 March 06, 2014 icedtea-web vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

DSA-2892-1 a2ps - security update

Bulletin has no description...

Debian Security Advisory DSA 2892-1 (a2ps - security update)

Several vulnerabilities have been found in a2ps, an Anything to PostScript converter and pretty-printer. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2001-1593 The spyuser function which is called when a2ps is invoked with the --debug flag insecurely use...

IcedTea Web information leakage

Weak permission for temporary files...

Debian: Security Advisory (DSA-2892-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Advisory 2953095: recommendation to stay protected and for detections

Today, Microsoft released Security Advisory 2953095 to notify customers of a vulnerability in Microsoft Word. At this time, we are aware of limited, targeted attacks directed at Microsoft Word 2010. This blog will discuss mitigations and temporary defensive strategies that will help customers to...

SuSE 11.3 Security Update : icedtea-web (SAT Patch Number 8974)

The OpenJDK Java Plugin IcedTea Web was released to fix a temporary file access problem. Changes : - Dialogs center on screen before becoming visible. - Support for u45 new manifest attributes Application-Name. - Custom applet permission policies panel in itweb-settings control panel. - Plugin...

CVE-2014-0135 rubygem-kafo: temporary file creation vulnerability when creating /tmp/default_values.yaml

Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for defaultvalues.yaml, which allows local users to obtain passwords and other sensitive information by reading the file...

Microsoft Silverlight DEP/ASLR安全限制绕过漏洞(CVE-2014-0319)

BUGTRAQ ID: 66046 CVECAN ID: CVE-2014-0319 Microsoft Silverlight是跨浏览器、跨平台的.NET实现，用于为Web构建媒体体验和交互应用。 Silverlight没有正确实现DEP和ASLR，在实现上存在安全限制绕过漏洞。成功利用后可导致绕过DEP/ASLR安全功能。 0 Microsoft Silverlight 5.x 临时解决方法： 临时在IE中阻止Microsoft Silverlight 临时阻止在Mozilla Firefox内运行Microsoft Silverlight 临时阻止在Mozilla...

Microsoft Internet Explorer内存破坏漏洞(CVE-2014-0297)

BUGTRAQ ID: 66023 CVECAN ID: CVE-2014-0297 Internet Explorer是微软公司推出的一款网页浏览器。 Internet Explorer 没有正确访问内存对象，在实现上存在远程代码执行漏洞，成功利用后可破坏内存，在当前用户权限下执行任意代码。 0 Microsoft Internet Explorer 6-11 临时解决方法： 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 设置互联网和内联网安全区域设置为“高” 配置IE在运行活动脚本之前提示或直接禁用。 应用Microsoft Fix...

Amazon Linux AMI : numpy (ALAS-2014-302)

f2py insecurely uses a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Linux A...

CVE-2014-1839

The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...

CVE-2014-1839

The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...

PYSEC-2014-83

The 1 extractkeysfrompdf and 2 fillpdf functions in pdfext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf...

CVE-2014-1839

The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...

PYSEC-2014-84

The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...

CVE-2014-1839

The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...

Low: numpy

Issue Overview: f2py insecurely uses a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py. Affected Packages: numpy Issue Correction: Run yum update numpy or yum update --advisory ALAS-2014-302 to...

Ubuntu 12.04 LTS / 12.10 / 13.10 : icedtea-web vulnerability (USN-2131-1)

Michael Scherer discovered that IcedTea Web created temporary directories in an unsafe fashion. A local attacker could possibly use this issue to obtain or modify sensitive information from other local user sessions. Note that Tenable Network Security has extracted the preceding description block...

USN-2131-1: IcedTea Web vulnerability

Michael Scherer discovered that IcedTea Web created temporary directories in an unsafe fashion. A local attacker could possibly use this issue to obtain or modify sensitive information from other local user sessions...