MGASA-2015-0101 Updated pngcrush package fixes security vulnerability

pngcrush-1.7.84 fixes defects reported by Coverity-scan, so it should be more resistant to crashes due to malformed input files, such as the one presented in CVE-2015-2158...

RedHat Update for qemu-kvm RHSA-2015:0349-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2015-0061 Updated e2fsprogs packages fix CVE-2015-0247

Updated e2fsprogs packages fix security vulnerability: The libext2fs library, part of e2fsprogs and utilized by its utilities, is affected by a boundary check error on block group descriptor information, leading to a heap based buffer overflow. A specially crafted filesystem image can be used to...

librsvg2 -- denial of service vulnerability

Adam Maris, Red Hat Product Security, reports: CVE-2015-7557: Out-of-bounds heap read in librsvg2 was found when parsing SVG file...

SUSE-SU-2015:0292-1 Security update for elfutils

elfutils was updated to fix one security issue. This security issue was fixed: - Directory traversal vulnerability in the readlongnames function CVE-2014-9447...

SOL15878 - bzip2 vulnerability CVE-2010-0405

Recommended action BIG-IP and Enterprise Manager If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate...

Multiple ManageEngine Products 7.0 - 9.0.054 Arbitrary File Upload Vulnerability

Multiple ManageEngine Products are prone to an arbitrary-file-upload vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

MGASA-2014-0365 Updated libgcrypt packages fix CVE-2014-5270

Updated libgcrypt packages fix security vulnerability: The libgcrypt library before version 1.5.4 is vulnerable to an ELGAMAL side-channel attack CVE-2014-5270...

CVE-2014-5398 Schneider Electric Wonderware Input Validation

Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

VirtualBox Guest Additions VBoxGuest.sys Privilege Escalation

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/exploit/local/windowskernel' require 'rex' class Metasploit3 'VirtualBox Guest Additions VBoxGuest.sys Privilege Escalation',...

MGASA-2014-0311 Updated php-ZendFramework packages fix security vulnerability

The implementation of the ORDER BY SQL statement in ZendDbSelect of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses CVE-2014-4914...

openssl098e security update

0.9.8e-29.2 - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability...

SUSE-SU-2015:0901-1 Security update for libtasn1

libtasn1 has been updated to fix three security issues: asn1getbitder could have returned negative bit length CVE-2014-3468 Multiple boundary check issues could have allowed DoS CVE-2014-3467 Possible DoS by NULL pointer dereference in asn1readvaluetype CVE-2014-3469 Security Issues: CVE-2014-346...

MGASA-2014-0270 Updated sendmail packages fix CVE-2014-3956

Updated sendmail packages fix security vulnerability: Sendmail before 8.14.9 does not properly closing file descriptors before executing programs. This bug could enable local users to interfere with an open SMTP connection if they can execute their own program for mail delivery e.g., via procmail...

SOL15318 - OpenSSL vulnerability CVE-2011-3207

Note: LineRate uses the specified vulnerable OpenSSL version, but CRL validation is not enabled, so the product is not vulnerable. Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed ...

SA-CONTRIB-2014-053 - Field API Tab Editor (FATE) - Access bypass

This module allows each entity field to be individually edited via its own custom page, accessible via a tab on the entity's page. The module returns an incorrect value to hookmenu if the current user does not have access to edit the entity. This allows users who would not normally have access to...

CVE-2011-3634

methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors...

KLA10277 LPE vulnerability in Norman Security Suite

An unspecified vulnerability was found in the Norman Security Suite. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited remotely via unknown vectors. Original advisories - Related products Norman-Security-Suite CVE list CVE-2014-0816 high...

MGASA-2014-0068 Updated perl-Capture-Tiny package fixes security vulnerability

perl-Capture-Tiny before 0.24 used files in /tmp in an insecure manner CVE-2014-1875...

Important: Red Hat Security Advisory: Apache Camel security update

An update for the Apache Camel component that fixes one security issue is now available from the Red Hat Customer Portal for Red Hat JBoss BRMS 6.0.0, and Red Hat JBoss BPMS 6.0.0. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability...