postgresql: information leak through constraint violation errors

An information leak flaw was found in the wathe PostgreSQL database server handled certain error messages. An authenticated database user could possibly obtain the results of a query they did not have privileges to execute by observing the constraint violation error messages produced when the que...

CVE-2015-1473

The ADDW macro in stdio-common/vfscanf.c in the GNU C Library aka glibc or libc6 before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service segmentation violatio...

CVE-2015-1473

The ADDW macro in stdio-common/vfscanf.c in the GNU C Library aka glibc or libc6 before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service segmentation violatio...

Code injection

The ADDW macro in stdio-common/vfscanf.c in the GNU C Library aka glibc or libc6 before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service segmentation violatio...

CVE-2015-1473

CVE-2015-1473 affects the GNU C Library (glibc) prior to version 2.21, arising from the ADDW macro in stdio-common/vfscanf.c not properly factoring data-type size when using alloca in a wscanf path. This can allow context-dependent attackers to cause a denial of service (segmentation fault) or ov...

CVE-2015-1473

The ADDW macro in stdio-common/vfscanf.c in the GNU C Library aka glibc or libc6 before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service segmentation violatio...

firefox: multiple issues

CVE-2015-0801 same-origin bypass Mozilla developer Olli Pettay reported that while investigating Mozilla Foundation Security Advisory 2015-28, he and Mozilla developer Boris Zbarsky found an alternate way to trigger a similar vulnerability. The previously reported flaw used an issue with SVG...

Fedora 21 setroubleshootd 3.2.22 - Local Privilege Escalation

setroubleshoot tries to find out which rpm a particular file belongs to when it finds SELinux access violation reports. The idea is probably to have convenient reports for the admin which type enforcement rules have to be relaxed. setroubleshoot runs as root although in its own domain. In util.py...

Fedora 21 setroubleshootd 3.2.22 - Local Privilege Escalation

Fedora 21 setroubleshootd 3.2.22 - Local Privilege Escalation setroubleshoot tries to find out which rpm a particular file belongs to when it finds SELinux access violation reports. The idea is probably to have convenient reports for the admin which type enforcement rules have to be relaxed...

Important: Red Hat Security Advisory: setroubleshoot security update

Updated setroubleshoot packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

Interactive Data eSignal Listener Buffer Overflow - Ver2 (CVE-2004-1868)

eSignal is a real-time market data and support tool provided by Interactive Data Corporation. The product supplies financial market data and more for traders over the internet. To facilitate the receipt of incoming data, eSignal opens a local, listening socket on TCP Port 80. There exists a buffe...

postgresql: information leak through constraint violation errors

An information leak flaw was found in the wathe PostgreSQL database server handled certain error messages. An authenticated database user could possibly obtain the results of a query they did not have privileges to execute by observing the constraint violation error messages produced when the que...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. MIT Kerberos 5 aka krb5 through 1.13.1 incorrectly expects that a krb5readmessage data field is represented as a string ending with a '\0' character, which allows remote attackers to 1 cause a denial of service NU...

PostgreSQL 'constraint-violation' information disclosure vulnerability

PostgreSQL is an object-relational database management system that supports an extended subset of SQL standards. The PostgreSQL constraint-violation error message discloses sensitive information and allows attackers to exploit the vulnerability to obtain sensitive information...

UBUNTU-CVE-2014-8161

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message...

PostgreSQL -- multiple buffer overflows and memory issues

PostgreSQL Project reports: This update fixes multiple security issues reported in PostgreSQL over the past few months. All of these issues require prior authentication, and some require additional conditions, and as such are not considered generally urgent. However, users should examine the list...

VideoLAN VLC Media Player 2.1.5 - DEP Access Violation

VideoLAN VLC Media Player 2.1.5 - DEP Access Violation Title : VLC Player 2.1.5 DEP Access Violation Vulnerability Discoverer: Veysel HATAS @muh4f1z Web page : www.binarysniper.net Vendor : VideoLAN VLC Project Test: Windows XP SP3 Status: Fixed Severity : High CVE ID : CVE-2014-9597 NIST:...

VideoLAN VLC Media Player 2.1.5 - Write Access Violation

Title : VLC Player 2.1.5 Write Access Violation Vulnerability Discoverer: Veysel HATAS @muh4f1z Web page : www.binarysniper.net Vendor : VideoLAN VLC Project Test: Windows XP SP3 Status: Fixed Severity : High CVE ID : CVE-2014-9598 NIST:...

VideoLAN VLC Media Player 2.1.5 - DEP Access Violation

Title : VLC Player 2.1.5 DEP Access Violation Vulnerability Discoverer: Veysel HATAS @muh4f1z Web page : www.binarysniper.net Vendor : VideoLAN VLC Project Test: Windows XP SP3 Status: Fixed Severity : High CVE ID : CVE-2014-9597 NIST: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-959...

VideoLAN VLC Media Player 2.1.5 - Write Access Violation

VideoLAN VLC Media Player 2.1.5 - Write Access Violation Title : VLC Player 2.1.5 Write Access Violation Vulnerability Discoverer: Veysel HATAS @muh4f1z Web page : www.binarysniper.net Vendor : VideoLAN VLC Project Test: Windows XP SP3 Status: Fixed Severity : High CVE ID : CVE-2014-9598 NIST:...