DLA-575-2 collectd - regression update

Bulletin has no description...

Moderate: Red Hat Bug Fix Advisory: Red Hat Satellite 6.2 Base Libraries

Red Hat Satellite 6.2 now available for Red Hat Enterprise Linux 5, 6 and 7 Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs...

Timing Attack

Overview Affected versions of cookie-signature are vulnerable to timing attacks as a result of using a fail-early comparison instead of a constant-time comparison. Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback on...

DSA-3629-1 ntp - security update

Bulletin has no description...

Debian DLA-546-2 : clamav version update

DLA 546-1 was incorrectly released before updated clamav packages were available and there were subsequent issues with the acceptance of the package which have since been corrected. Updates are now available for all supported LTS architectures. We recommend that you upgrade your clamav packages...

DoS due to excessively large websocket message

Overview Affected versions of ws do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload. Recommendation Update to version 1.1.1 or later. Alternatively, set the maxpayload...

Threat Outbreak Alert RuleID23175: Email Messages Distributing Malicious Software on May 29, 2016

Medium Alert ID: 46449 First Published: 2016 May 31 14:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23175 may contain the following files: Name | Size...

Cybozu Garoon vulnerable to open redirect

Overview Cybozu Garoon is a groupware. Cybozu Garoon contains an open redirect vulnerability. Jun Kokatsu of KDDI Singapore Dubai Branch reported this vulnerability to Cybozu, Inc., and Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC an...

MGASA-2016-0195 Updated networkmanager packages fix CVE-2016-0764

Updated networkmanager package fixes security vulnerability: NetworkManager before 1.0.12 is vulnerable to a race condition that could lead to a local information leak CVE-2016-0764. The networkmanager package has been updated to version 1.0.12, which fixes this issue and several other bugs. See...

PT-2016-1976 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 21.0.0.213 and earlier Description: The issue is related to errors in the code of the Flash Player platform, which can be exploited by a remote attacker to impact the integrity, availability, and confidentiality of...

MGASA-2016-0167 Updated owncloud packages fix security vulnerabilities

Updated owncloud package fixes security vulnerabilities: The owncloud package has been updated to version 8.0.12, which fixes undisclosed security issues and other bugs...

DSA-3566-1 openssl - security update

Bulletin has no description...

Multiple shiro8 Co., Ltd. freearea_ addition_plugins for EC-CUBE vulnerable to cross-site scripting

Overview EC-CUBE plugin "categoryfreearea additionplugin" and "itemdetailfreearea additionplugin" provided by shiro8 Co., Ltd. contain a cross-site scripting vulnerability CWE-79. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

PT-2016-4418 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 1.650 Jenkins LTS versions prior to 1.642.2 Description: The issue allows remote authenticated users to execute arbitrary code via serialized data in an XML file. This is related to XStream and the groovy.util.Expand...

baserCMS plugin "Casebook Plugin" vulnerable to cross-site scripting

Overview baserCMS plugin "Casebook Plugin" contains a cross-site scripting vulnerability CWE-79. Takaesu Isao of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...

Insecure Default Configuration

Overview Affected versions of airbrake default to sending environment variables over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible for them to capture and read these environment variables, which may result in leaking sensitive...

Updated webkit packages fix security vulnerability

The webkit package has been updated to version 2.4.10, fixing several security issues and other bugs...

KLA10777 Code execution vulnerability in ABB Panel Builder 800

An unspecified vulnerability was found in ABB Panel Builder 800. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a DLL hijack. Technical details This vulnerability can be mitigated via disabling .pba files associations...

PT-2016-2810

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 7.3 Description The issue is related to a password hashing error in the ssh network protocol. When SHA256 or SHA512 are used for user password hashing, a timing difference in responses can be leveraged by remote...

MGASA-2016-0097 Updated graphite2 package fixes security vulnerabilities

Updated graphite2 packages fix security vulnerabilities: Multiple security flaws were found in the graphite2 font library. A web page or document containing malicious content could cause an application using graphite2 to crash or, potentially, execute arbitrary code with the privileges of the use...