2401 matches found
Aika 0.2 colladaconverter Xml Parsing Buffer Overflow
No description provided by source. / ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Exploit Title: Aika colladaconverter buffer overflow exploit Date: 09/11/2011 Author: isciurus Software Link:...
Apple iTunes 7.0.2 XML Parsing Remote Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/22615/info Apple iTunes is prone to a remote denial-of-service vulnerability because the application fails to handle malformed XML playlist files. An attacker can exploit this issue to crash the application, triggering a...
VMware Server <= 2.0.1,ESXi Server <= 3.5 Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/36842/info VMware products are prone to a directory-traversal vulnerability because they fail to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information...
Remote DoS Exploit on Confluence
Nir Goldshlager have discovered a vulnerability on atlassian-gadgets when parsing XMLs. Basically anyone can craft a URL containing a parameter with some XML that will make the instance run out of memory when trying to parse it. Details on the attack can be found on...
Remote DoS Exploit on Confluence
Nir Goldshlager have discovered a vulnerability on atlassian-gadgets when parsing XMLs. Basically anyone can craft a URL containing a parameter with some XML that will make the instance run out of memory when trying to parse it. Details on the attack can be found on...
openSUSE Security Update : libvirt (openSUSE-SU-2013:0885-1)
This update of libvirt fixes two problems : - fix leak after listing all volumes - CVE-2013-1962 ca697e90-CVE-2013-1962.patch bnc820397 - Fix parsing of bond interface XML 5ba077dc-iface-bond.patch bnc810893 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...
openSUSE Security Update : chromium (openSUSE-SU-2014:0065-1)
Update to Chromium 31.0.1650.63 Stable channel update : - Security fixes : - CVE-2013-6634: Session fixation in sync related to 302 redirects - CVE-2013-6635: Use-after-free in editing - CVE-2013-6636: Address bar spoofing related to modal dialogs - CVE-2013-6637: Various fixes from internal...
openSUSE Security Update : libvirt (openSUSE-SU-2014:0674-1)
This update fixes the following issues with libvirt : - bnc875694: Fix migration with QEMU 1.6. QEMU 1.6.0 introduced new migration status: setup. Libvirt does not expect such string in QMP and refuses to migrate with error 'unexpected migration status in setup' - Patch to prevent expansion of...
Updated libvirt packages fix multiple vulnerabilities
Updated libvirt packages fix security vulnerabilities: The LXC driver lxc/lxcdriver.c in libvirt 1.0.1 through 1.2.1 allows local users to 1 delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; 2 create arbitrary nodes mknod via the...
libvirt security update
CentOS Errata and Security Advisory CESA-2014:0560 Updated libvirt packages that fix one security issue and three bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring Syst...
RHEL 6 : libvirt (RHSA-2014:0560)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0560 advisory. The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition,...
Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20140527)
It was found that libvirt passes the XMLPARSENOENT flag when parsing XML documents using the libxml2 library, in which case all XML entities in the parsed documents are expanded. A user able to force libvirtd to parse an XML document with an entity pointing to a special file that blocks on read...
Moderate: Red Hat Security Advisory: libvirt security and bug fix update
Updated libvirt packages that fix one security issue and three bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
Fedora 20 : libvirt-1.1.3.5-2.fc20 (2014-6586)
Fix xen hvm VNC port bz 1094262 - CVE-2014-0179: Unsafe XML parsing bz 1094792, bz 1088290 - Fix failure to start xen instances rackspace in particular bz 1098376 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable...
Ruby OpenID: Denial of service
Background Ruby OpenID is a robust library for verifying and serving OpenID identities. Description An XML entity parsing error has been discovered in Ruby OpenID. Impact A remote attacker could send a specially crafted XML file, possibly resulting in a Denial of Service condition. Workaround The...
libxml2 DoS
CPU exhaustion on XML parsing...
CVE-2014-0191
The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation i...
OpenJDK: XML parsing Denial of Service (JAXP, 8014530)
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via vectors related to JAXP...
OpenJDK: XML parsing Denial of Service (JAXP, 8017298)
A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an...