SUSE-SU-2015:1073-1 Security update for java-1_7_0-ibm

This update fixes the following security issues: - Version bump to 7.1-3.0 release bnc930365 CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 - Fix removeing links before update-alternatives run. bnc931702 - Fix bnc912434, javaws/plugin stuff should slave plugin update-alternatives - Fix...

SUSE-SU-2015:0939-1 Security update for tigervnc, fltk

tigervnc and fltk were updated to fix security issues and non-security bugs. This security issue was fixed: - CVE-2015-0255: Information leak in the XkbSetGeometry request of X servers bnc915810. These non-security issues were fixed: - vncviewer-tigervnc does not display mouse cursor shape change...

Updated pdns & pdns-recursor packages fix CVE-2015-1868

Updated pdns and pdns-recursor packages fix security vulnerability: A bug was discovered in the label decompression code in PowerDNS and PowerDNS Recursor, making it possible for names to refer to themselves, thus causing a loop during decompression. On some platforms, this bug can be abused to...

MGASA-2015-0178 Updated ruby packages fix CVE-2015-1855

Updated ruby packages fix security vulnerability: Ruby OpenSSL hostname matching implementation violates RFC 6125 CVE-2015-1855. The ruby package has been updated to version 2.0.0-p645, which fixes this issue...

MGASA-2015-0166 Updated libksba packages fix security vulnerabilities

The libksba package has been updated to version 1.3.3, which fixes an integer overflow in the DN decoder and a couple of other minor bugs...

MGASA-2015-0157 Updated python-dulwich packages fix security vulnerabilities

Updated python-dulwich package fixes security vulnerabilities: It was discovered that Dulwich allows writing to files under .git/ when checking out working trees. This could lead to the execution of arbitrary code with the privileges of the user running an application based on Dulwich...

PT-2015-5459 · Chrony +3 · Chrony +3

Name of the Vulnerable Software and Affected Versions: chrony versions prior to 1.31.1 Description: The issue allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via a large number of command requests, due to the failure to initialize the last "next"...

KLA10506 Multiple vulnerabilities in Websense products

Multiple serious vulnerabilities have been found in Websense products. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, execute or inject arbitrary code, spoof user interface and read or write arbitrary files. Below is a complete lis...

DLA-179-1 tzdata - new upstream version

Bulletin has no description...

openSUSE Security Update : perl-YAML-LibYAML (openSUSE-2015-162)

perl-YAML-LibYAML was updated to version 0.59 to fix four security issues. These security issues were fixed : - CVE-2013-6393: The yamlparserscantaguri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allowed remote attackers to cause a denial of service application...

WordPress Shopping Cart 3.0.4 - Unrestricted File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Shopping Cart 3.0.4 Unrestricted File Upload Date: 29-10-2014 Software Link: https://wordpress.org/plugins/wp-easycart/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website:...

CMS Serendipity 2.0-rc1 Cross Site Scripting

Advisory: Stored XSS Vulnerability in CMS Serendipity v.2.0-rc1 Advisory ID: SROEADV-2014-02 Author: Steffen Rösemann Affected Software: CMS Serendipity v.2.0-rc1 Release: 20th Dec 2014 Vendor URL: http://www.s9y.org/ Vendor Status: fixed CVE-ID: - ========================== Vulnerability...

MGASA-2014-0542 Updated php packages fix CVE-2014-8142

Updated php packages fix security vulnerability: A use-after-free flaw was found in PHP unserialize. An untrusted input could cause PHP interpreter to crash or, possibly, execute arbitrary code when processed using unserialize CVE-2014-8142. PHP has been updated to version 5.5.20, which fixes the...

PT-2014-8879 · Innominate · Mguard

Name of the Vulnerable Software and Affected Versions: Innominate mGuard versions prior to 7.6.6 Innominate mGuard versions 8.x prior to 8.1.4 Description: The issue allows remote authenticated administrators to gain root privileges by modifying a specific PPP configuration setting...

MGASA-2014-0495 Updated phpmyadmin packages fix security vulnerabilities

Updated phpmyadmin package fixes security vulnerabilities: In phpMyAdmin before 4.1.14.7, with a crafted database, table or column name it is possible to trigger an XSS attack in the table browse page, with a crafted ENUM value it is possible to trigger XSS attacks in the table print view and zoo...

[SECURITY] [DLA 92-1] tomcat-native security followup update

Package : tomcat-native Version : 1.1.31-1deb6u1 This is an upgrade from tomcat-native 1.1.20 the version previously available in squeeze to 1.1.31, the full list of changes between these versions can be seen in the upstream changelog, which is available online at...

PT-2014-2424 · Jquery +2 · Jquery Ui +2

Name of the Vulnerable Software and Affected Versions: jQuery UI versions prior to 1.10.0 Description: A cross-site scripting XSS issue exists in the default content option in jquery.ui.tooltip.js in the Tooltip widget. This allows remote attackers to inject arbitrary web script or HTML via the...

SuSE 11.3 Security Update : MozillaFirefox (SAT Patch Number 9972)

This version update of Mozilla Firefox to 31.2.0ESR brings improvements, stability fixes and also security fixes for the following CVEs : CVE-2014-1574 / CVE-2014-1575 / CVE-2014-1576 / CVE-2014-1577 / CVE-2014-1578 / CVE-2014-1581 / CVE-2014-1583 / CVE-2014-1585 / CVE-2014-1586 It also disables...

MGASA-2014-0447 Updated libreoffice packages fix security vulnerabilities

It was discovered during routine code review that LibreOffice unconditionally executed certain VBA macros on loading Microsoft Office documents, contrary to user expectations CVE-2014-0247. A vulnerability in LibreOffice allows an attacker to send a document which when opened will trigger the...

PT-2014-8628 · Citrix · Citrix Netscaler Application Delivery Controller +1

Name of the Vulnerable Software and Affected Versions: Citrix NetScaler Application Delivery Controller and NetScaler Gateway versions 10.5.50.10 through 10.5-52.10 Citrix NetScaler Application Delivery Controller and NetScaler Gateway versions 10.1.122.17 through 10.1-129.10 Citrix NetScaler...