[slackware-security] curl

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.74.0-i586-1slack14.2.txz: Upgraded. This release includes the following security related bugfixes: Inferior OCSP...

Default configuration

When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that...

CVE-2020-1938

When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that...

Cisco Data Center Network Manager TrustedClientTokenValidator Hard-coded Cryptographic Key Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Cisco Data Center Network Manager. The specific flaw exists within the processing of the dbadmin/addUser functionality. The issue results from trusting input that has been encrypted with a hard-coded...

Debian DSA-3994-1 : nautilus - security update

Christian Boxdorfer discovered a vulnerability in the handling of FreeDesktop.org .desktop files in Nautilus, a file manager for the GNOME desktop environment. An attacker can craft a .desktop file intended to run malicious commands but displayed as a innocuous document file in Nautilus. An user...

MS16-088: Description of the security update for Excel 2010: July 12, 2016

MS16-088: Description of the security update for Excel 2010: July 12, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...

CVE-2015-2309: Unsafe methods in the Request class

Affected Versions All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as the...

Researchers Finds Malicious Tor Exit Node Adding Malware to Binaries

A security researcher has identified a Tor exit node that was actively patching binaries users download, adding malware to the files dynamically. The discovery, experts say, highlights the danger of trusting files downloaded from unknown sources and the potential for attackers to abuse the trust...

HP LoadRunner Unspecified Arbitrary Remote Code Execution

The version of HP LoadRunner installed on the remote host reportedly blindly trusts user-supplied data as an allocation size and uses to copy data from a request packet into a statically allocated heap buffer. A remote attacker who is able to contact TCP ports 5001 or 5002 on the remote host can...

Web page content can display misleading security information – Opera Security Advisories

Dialogs such as the security information dialog and download dialog are displayed over the top of the webpage content. In some cases, webpage content will be incorrectly displayed on top of the dialogs, or over parts of the dialogs. This content can then display misleading security information,...

Lianzhong game lobby GlobalLink glItemCom.dll SetInfo()use analyze-vulnerability warning-the black bar safety net

author: voidph4nt0m.org pub: 2008-09-04 http://www.ph4nt0m.org Text Mode Affected version: Lianzhong game lobby 2. 7. 0. 8 2 0 0 7 years 8 months 1 6, released Unaffected version: Ourgame also didn't fill :- Genesis: With all the programmers are too trusting user input,not detecting the user...

Privilege escalation via DOM property overrides — Mozilla

mozbugra4 reported several exploits giving an attacker the ability to install malicious code or steal data, requiring only that the user do commonplace actions like click on a link or open the context menu. The common cause in each case was privileged UI code "chrome" being overly trusting of DOM...

CVE-2002-0018

In Windows NT/Windows 2000, a domain trust relationship can be abused when a trusting domain accepts authorization data (SIDs) from a trusted domain without verifying that the trusted domain is authoritative for all SIDs. The root cause is failure to validate all SIDs in the authorization data su...