Fedora 15 : xorg-x11-server-utils-7.5-5.fc15 (2011-4984)

fixes CVE-2011-0465 root hole via rogue hostname in xrdb Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issue...

Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : nss vulnerabilities (USN-1106-1)

It was discovered that several invalid HTTPS certificates were issued and revoked. An attacker could exploit these to perform a man in the middle attack to view sensitive information or alter encrypted communications. These certificates were marked as explicitly not trusted to prevent their misus...

ZDI-11-115: IBM solidDB solid.exe Authentication Bypass Remote Code Execution Vulnerability

ZDI-11-115: IBM solidDB solid.exe Authentication Bypass Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-115 April 1, 2011 -- CVSS: 9.3, AV:N/AC:M/Au:N/C:C/I:C/A:C -- Affected Vendors: IBM -- Affected Products: IBM solidDB -- TippingPointTM IPS Customer...

Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : tiff vulnerability (USN-1102-1)

Martin Barbella discovered that the thunder aka ThunderScan decoder in the TIFF library incorrectly handled an unexpected BitsPerSample value. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could execute arbitrary code with user privilege...

Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : ffmpeg vulnerabilities (USN-1104-1)

Cesar Bernardini and Felipe Andres Manzano discovered that FFmpeg incorrectly handled certain malformed flic files. If a user were tricked into opening a crafted flic file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of...

Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : qt4-x11 vulnerabilities (USN-1101-1)

It was discovered that several invalid HTTPS certificates were issued and revoked. An attacker could exploit these to perform a man in the middle attack to view sensitive information or alter encrypted communications. These were placed on the certificate blacklist to prevent their misuse. Note th...

Fedora 14 : php-doctrine-Doctrine-1.2.4-1.fc14 (2011-4098)

upstream 1.2.4 security update, see: http://www.doctrine-project.org/blog/doctrine-security-fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possib...

Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : openldap, openldap2.3 vulnerabilities (USN-1100-1)

It was discovered that OpenLDAP did not properly check forwarded authentication failures when using a slave server and chain overlay. If OpenLDAP were configured in this manner, an attacker could bypass authentication checks by sending an invalid password to a slave server. CVE-2011-1024 It was...

Fedora 14 : pure-ftpd-1.0.30-1.fc14 (2011-3349)

Wietse Venema and Victor Duchovni discovered and reported an issue that could lead to a potential information disclosure. An unencrypted FTP command immediately following STARTTLS request would get buffered and processed prior to SSL/TLS handshake, resulting in potential authentication bypass in...

Ubuntu 9.10 / 10.04 LTS / 10.10 : gdm vulnerability (USN-1099-1)

Sebastian Krahmer discovered that GDM GNOME Display Manager did not properly drop privileges when handling the cache directories used to store users' dmrc and face icon files. This could allow a local attacker to change the ownership of arbitrary files, thereby gaining root privileges. Note that...

Fedora 13 : wordpress-3.1-1.fc13 (2011-3738)

In order to protect against two CVEs, I'm upgrading Wordpress in all releases to 3.1. In addition, this will obsolete wordpress-mu, since this functionality has been migrated to the main wordpress release as of wordpress 3.0, and wordpress-mu has been deprecated upstream. I would not normally mak...

Fedora 15 : roundcubemail-0.5.1-1.fc15 (2011-4038)

Roundcube Webmail upstream has released v0.5.1 version: 1 http://trac.roundcube.net/wiki/Changelog which adds one security hardening: 1, Security: add optional referer check to prevent CSRF in GET requests Relevant patches: 2 http://trac.roundcube.net/changeset/4503 3...

Fedora 15 : php-doctrine-Doctrine-1.2.4-1.fc15 (2011-4056)

upstream 1.2.4 security update, see: http://www.doctrine-project.org/blog/doctrine-security-fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possib...

Fedora 15 : asterisk-1.8.3.2-1.fc15 (2011-3958)

The Asterisk Development Team has announced security releases for Asterisk branches 1.6.1, 1.6.2, and 1.8. The available security releases are released as versions 1.6.1.24, 1.6.2.17.2, and 1.8.3.2. These releases are available for immediate download at...

Fedora 14 : gnash-0.8.9-1.fc14 (2011-3658)

---------------------------------------------------------------------- ---------- ChangeLog : - Fri Mar 18 2011 Hicham HAOUARI - 1:0.8.9-1 - Update to 0.8.9 final - Sat Mar 12 2011 Hicham HAOUARI - 1:0.8.9-0.1.20110312git - Switch to 0.8.9 branch - Spec cleanup - Add extensions - Enable testsuite...

Fedora 15 : subversion-1.6.16-1.fc15 (2011-3775)

A NULL pointer dereference flaw was found in the way the moddavsvn module processed certain requests to lock working copy paths in a repository. A remote attacker could issue a lock request that could cause the httpd process serving the request to crash. CVE-2011-0715 The Fedora Project would lik...

Solaris 10 (sparc) : 146857-01

SunOS 5.10: ssl patch for wanboot. Date this patch was last updated by Sun : Mar/23/11 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

AIX 610003 : U838079

The remote host is missing AIX PTF U838079 which is related to the security of the package bos.sysmgt.nim.client You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

Fedora 15 : php-pear-1.9.2-1.fc15 (2011-2367)

Upstream Changelog : Important! This is a security fix release. The advisory can be found at http://pear.php.net/advisory-20110228.txt Bugs : - Fixed Bug 17463: Regression: On Windows, svntag patch by doconnor - Fixed Bug 17641: pecl-list doesn't sort packages by name dufuz - Fixed Bug 17781:...

Fedora 14 : samba-3.5.8-74.fc14 (2011-3118)

Tue Mar 8 2011 Guenther Deschner - 3.5.8-74 - Update to 3.5.8 - resolves: 596830 - Thu Mar 3 2011 Guenther Deschner - 3.5.7-73 - Security update to 3.5.7 to address CVE-2011-0719 - resolves: 681852 - Thu Jan 6 2011 Guenther Deschner - 3.5.6-72 - Fix GSSAPI checksum for some SMB servers -...