Oracle Solaris Third-Party Patch Update : librsvg (cve_2011_3146_denial_of)

The remote Solaris system is missing necessary patches to address security updates : - librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service NULL pointer dereference and possibly execute arbitrary code via a SV...

Oracle Solaris Third-Party Patch Update : ejabberd (cve_2013_6169_cryptographic_issues)

The remote Solaris system is missing necessary patches to address security updates : - The modpubsub module modpubsub.erl in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service infinite loop via a stanza with a publish tag that lacks a node attribute...

Oracle Solaris Third-Party Patch Update : gnutls (cve_2011_4128_buffer_overflow)

The remote Solaris system is missing necessary patches to address security updates : - Buffer overflow in the gnutlssessiongetdata function in lib/gnutlssession.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remot...

Oracle Solaris Third-Party Patch Update : wireshark (denial_of_service_vulnerability_in)

The remote Solaris system is missing necessary patches to address security updates : - The prototreeadditem function in Wireshark 1.6.0 through 1.6.1 and 1.4.0 through 1.4.8, when the IKEv1 protocol dissector is used, allows user-assisted remote attackers to cause a denial of service infinite loo...

Oracle Solaris Third-Party Patch Update : libxtsol (cve_2014_0397_buffer_errors)

The remote Solaris system is missing necessary patches to address security updates. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Oracle Third Party software advisories. include'deprecatednasllevel.inc';...

Oracle Solaris Third-Party Patch Update : quagga (cve_2012_1820_denial_of)

The remote Solaris system is missing necessary patches to address security updates : - ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service infinite loop and hang via a crafted image whose IFD contains IOP tags that all reference the beginning of the IDF...

Oracle Solaris Third-Party Patch Update : samba (cve_2012_6150_input_validation)

The remote Solaris system is missing necessary patches to address security updates : - The winbindnamelisttosidstringlist function in nsswitch/pamwinbind.c in Samba through 4.1.2 handles invalid requiremembershipof group names by accepting authentication by any user, which allows remote...

Oracle Solaris Third-Party Patch Update : libotr (cve_2012_3461_denial_of)

The remote Solaris system is missing necessary patches to address security updates : - The 1 otrlbase64otrdecode function in src/b64.c; 2 otrlprotodatareadflags and 3 otrlprotoacceptdata functions in src/ proto.c; and 4 decode function in toolkit/parse.c in libotr before 3.2.1 allocates a...

Oracle Solaris Third-Party Patch Update : facter (cve_2014_3248_untrusted_search)

The remote Solaris system is missing necessary patches to address security updates : - Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when...

Oracle Solaris Third-Party Patch Update : kerberos (cve_2014_4345_numeric_errors)

The remote Solaris system is missing necessary patches to address security updates : - Off-by-one error in the krb5encodekrbsecretkey function in plugins/kdb/ldap/ libkdbldap/ldapprincipal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 aka krb5 1.6.x through 1.11.x before 1.11.6 and 1.12....

Oracle Solaris Third-Party Patch Update : freetype (multiple_buffer_errors_vulnerabilities_in)

The remote Solaris system is missing necessary patches to address security updates : - FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service NULL pointer dereference and crash via vectors related to BDF fonts and the improper handling of an 'allocation error' in t...

Oracle Solaris Third-Party Patch Update : libtiff (cve_2012_5581_denial_of)

The remote Solaris system is missing necessary patches to address security updates : - Stack-based buffer overflow in tifdir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image...

Oracle Solaris Third-Party Patch Update : hplip (cve_2013_0200_link_following)

The remote Solaris system is missing necessary patches to address security updates : - HP Linux Imaging and Printing HPLIP through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the 1 /tmp/hpcupsfilterc .bmp, 2 /tmp/hpcupsfilterk.bmp, 3 /tmp/hpcupsjob.out, 4...

Oracle Solaris Third-Party Patch Update : fetchmail (multiple_vulnerabilities_in_fetchmail) (BEAST)

The remote Solaris system is missing necessary patches to address security updates : - The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained...

Security Advisory AA-004: Directory Traversal Vulnerability in Sitecom Home Storage Center

Security Advisory AA-004: Directory Traversal Vulnerability in Sitecom Home Storage Center Severity Rating: High Discovery Date: July 29, 2012 Vendor Notification: July 30, 2012 Disclosure Date: September 3, 2012 Vulnerability Type= Directory Traversal Impact= - System Access - Exposure of...

Sitecom Home Storage Center - Directory Traversal

Sitecom Home Storage Center - Directory Traversal Security Advisory AA-004: Directory Traversal Vulnerability in Sitecom Home Storage Center Severity Rating: High Discovery Date: July 29, 2012 Vendor Notification: July 30, 2012 Disclosure Date: September 3, 2012 Vulnerability Type= Directory...

Sitecom Home Storage Center Directory Traversal

Exploit for hardware platform in category web applications Directory Traversal Vulnerability in Sitecom Home Storage Center Severity Rating: High Discovery Date: July 29, 2012 Vendor Notification: July 30, 2012 Disclosure Date: September 3, 2012 Vulnerability Type= Directory Traversal Impact= -...

New Java Zero Day Being Used in Targeted Attacks

There is a newly discovered zero day vulnerability in Java 7 that is being used in some targeted attacks right now. The vulnerability works against Internet Explorer and Firefox and researchers say that attackers are exploiting in the wild and installing a version of the Poison Ivy RAT on...

[security bulletin] HPSBGN02501 SSRT071407 rev.1 - HP ProCurve 1800 Switches running SNMP, Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02436028 Version: 1 HPSBGN02501 SSRT071407 rev.1 - HP ProCurve 1800 Switches running SNMP, Remote Disclosure of Information NOTICE: The information in this Security Bulletin should be acted upon ...

Linux kernel 2.6.x cifs_create()函数空指针引用漏洞

BUGTRAQ ID: 39186 CVE ID: CVE-2010-1148 Linux Kernel是开放源码操作系统Linux所使用的内核 Linux Kernel的fs/cifs/dir.c文件中的cifscreate函数存在空指针引用错误。在支持unix扩展（如Samba）的服务器上创建文件时，如果所创建的文件没有提供nameidata（nd为空），cifs客户端在调用cifsposixopen时就会崩溃 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...