Ubuntu 9.10 / 10.04 LTS / 10.10 : krb5 vulnerability (USN-1088-1)

Cameron Meadors discovered that the MIT Kerberos 5 Key Distribution Center KDC daemon is vulnerable to a double-free condition if the Public Key Cryptography for Initial Authentication PKINIT capability is enabled. This could allow a remote attacker to cause a denial of service. Note that Tenable...

Fedora 13 : vsftpd-2.3.4-1.fc13 (2011-2615)

Thu Mar 3 2011 Jiri Skala - 2.3.4-1 - update to latest upstream 2.3.4 - fixes 681935 - CVE-2011-0762 vsftpd: remote DoS via crafted glob pattern - Mon May 17 2010 Jiri Skala - 2.2.2-7 - when listenipv6=YES sets socket option to listen IPv6 only - Fri May 14 2010 Jiri Skala - 2.2.2-6 -...

Fedora 15 : pywebdav-0.9.4.1-1.fc15 (2011-2427)

The server affected by the CVE is distributed only as documentation, not as a directly runnable component. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as muc...

Fedora 13 : firefox-3.6.14-1.fc13 / galeon-2.0.7-37.fc13 / gnome-python2-extras-2.25.3-26.fc13 / etc (2011-2447)

Update to new upstream Firefox version 3.6.14, fixing multiple security issues detailed in the upstream advisories : http://www.mozilla.org/security/known-vulnerabilities/firefox36.htmlf irefox3.6.14 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox ...

Fedora 13 : moin-1.9.3-4.fc13 (2011-2157)

Thu Feb 24 2011 Ville-Pekka Vainio - 1.9.3-4 - Fixes CVE-2011-1058 rhbz679523 - Tue Feb 8 2011 Fedora Release Engineering - 1.9.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora15MassRebuild - Fri Jul 23 2010 Ville-Pekka Vainio 1.9.3-2 - Rebuilt for...

Ubuntu 10.04 LTS / 10.10 : thunderbird vulnerabilities (USN-1050-1)

Jesse Ruderman, Igor Bukanov, Olli Pettay, Gary Kwong, Jeff Walden, Henry Sivonen, Martijn Wargers, David Baron and Marcia Knous discovered several memory issues in the browser engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the...

Fedora 15 : gitolite-1.5.8-3.fc15 (2011-1616)

Dylan Alex Simon discovered and reported a directory traversal flaw in the way Gitolite restricted access to admin defined commands 'ADC'. An authenticated attacker could execute arbitrary code with privileges of Gitolite server user using specially crafted command name. The flaw does not affect...

Ubuntu 9.10 / 10.04 LTS / 10.10 : clamav vulnerability (USN-1076-1)

It was discovered that the Microsoft Office processing code in libclamav improperly handled certain Visual Basic for Applications VBA data. This could allow a remote attacker to craft a document that could crash clamav or possibly execute arbitrary code. In the default installation, attackers wou...

Fedora 13 : telepathy-gabble-0.10.5-1.fc13 / telepathy-glib-0.11.16-2.fc13 (2011-1903)

The remote Fedora host is missing one or more security updates : telepathy-glib-0.11.16-2.fc13 : - Sun Feb 20 2011 Brian Pepple - 0.11.16-2 - Drop devel require on tp-glib-vala. - Sun Feb 20 2011 Brian Pepple - 0.11.16-1 - Update to 0.11.16. - Bump min version of glib required. - Tue Jun 22 2010...

Solaris 10 (sparc) : 143937-03

SunOS 5.10: rdist patch. Date this patch was last updated by Sun : Feb/24/11 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if ! definedfunc"bnrandom"...

Fedora 13 : phpMyAdmin-3.3.9.2-1.fc13 (2011-1373)

Changes for 3.3.9.1 2011-02-08 - security Path disclosure, see PMASA-2011-1 - http://www.phpmyadmin.net/homepage/security/PMASA-201 1-1.php Changes for 3.3.9.2 2011-02-11 - security SQL injection, see PMASA-2011-2 - http://www.phpmyadmin.net/homepage/security/PMASA-201 1-2.php Note that Tenable...

Fedora 14 : phpMyAdmin-3.3.9.2-1.fc14 (2011-1408)

Changes for 3.3.9.1 2011-02-08 - security Path disclosure, see PMASA-2011-1 - http://www.phpmyadmin.net/homepage/security/PMASA-201 1-1.php Changes for 3.3.9.2 2011-02-11 - security SQL injection, see PMASA-2011-2 - http://www.phpmyadmin.net/homepage/security/PMASA-201 1-2.php Note that Tenable...

AIX 530011 : U840381

The remote host is missing AIX PTF U840381 which is related to the security of the package devices.fcp.tape.rte You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

AIX 530012 : U838595

The remote host is missing AIX PTF U838595 which is related to the security of the package security.pkcs11.tools You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : mailman vulnerabilities (USN-1069-1)

It was discovered that Mailman did not properly sanitize certain fields, resulting in cross-site scripting XSS vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to...

Fedora 14 : gitolite-1.5.3-2.fc14 (2011-1644)

Dylan Alex Simon discovered and reported a directory traversal flaw in the way Gitolite restricted access to admin defined commands 'ADC'. An authenticated attacker could execute arbitrary code with privileges of Gitolite server user using specially crafted command name. The flaw does not affect...

Fedora 14 : krb5-1.8.2-8.fc14 (2011-1225)

This update incorporates fixes from upstream advisories MITKRB5-SA-2011-001 standalone kpropd exits if a per-client child exits with an error and MITKRB5-SA-2011-002 uninitialized pointer crash in the KDC, hang or crash in the KDC with the LDAP backend. Note that Tenable Network Security has...

Ubuntu 10.04 LTS / 10.10 : openssl vulnerability (USN-1064-1)

Neel Mehta discovered that incorrectly formatted ClientHello handshake messages could cause OpenSSL to parse past the end of the message. This could allow a remote attacker to cause a crash and denial of service by triggering invalid memory accesses. Note that Tenable Network Security has extract...

Ubuntu 9.10 / 10.04 LTS / 10.10 : qemu-kvm vulnerability (USN-1063-1)

Neil Wilson discovered that if VNC passwords were blank in QEMU configurations, access to VNC sessions was allowed without a password instead of being disabled. A remote attacker could connect to running VNC sessions of QEMU and directly control the system. By default, QEMU does not start VNC...

Fedora 13 : mod_auth_mysql-3.0.0-12.fc13 (2011-0114)

This update fixes a security issue in modauthmysql. A flaw was found in the way modauthmysql escaped certain multibyte-encoded strings. If modauthmysql was configured to use a multibyte character set that allowed a backslash '' as part of the character encodings, a remote attacker could inject...