Security Bulletin: Openssh vulnerabilities affect IBM SmartClound Entry (CVE-2015-5352 CVE-2015-6563 CVE-2015-6564)

Summary IBM SmartCloud Entry is vulnerable to multiple OpenSSH vulnerabilities. An attacker could exploit these vulnerabilities to bypass XSECURITY restrictions, conduct impersonation attacks, or gain elevated privileges on the system. Vulnerability Details CVEID: CVE-2015-5352 DESCRIPTION: OpenS...

CareerUp < 2.3.1 - Unauthenticated Reflected Cross-Site Scripting

There are unauthenticated reflected Cross-Site Scripting XSS vulnerabilities in CareerUp theme, via the filter parameters. Edit WPScanTeam May 27th, 2020 - Vendor Contacted by Original Submitter. May 29th, 2020 - v2.3.0 Released. Unclear if issue fixed. June 18th, 2020 - Another submitter Vlad...

RHEL 6 : openssh (RHSA-2016:0741)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0741 advisory. - openssh: XSECURITY restrictions bypass under certain conditions in ssh1 CVE-2015-5352 - openssh: Privilege separation weakness related to...

OpenSSH < 6.9 Multiple Vulnerabilities

Binary data 9308.prm...

Oracle Linux 7 : openssh (ELSA-2015-2088)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2088 advisory. - Security fixes released with openssh-6.9 CVE-2015-5352 1247864 - XSECURITY restrictions bypass under certain conditions in ssh1 1238231 - weakness of...

openssh security, bug fix, and enhancement update

6.6.1p1-22 - Use the correct constant for glob limits 1160377 6.6.1p1-21 - Extend memory limit for remote glob in sftp acc. to stat limit 1160377 6.6.1p1-20 - Fix vulnerabilities published with openssh-7.0 1265807 - Privilege separation weakness related to PAM support - Use-after-free bug related...

Mageia: Security Advisory (MGASA-2015-0271)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AIX OpenSSH Vulnerability : openssh_advisory5.asc

The version of OpenSSH running on the remote host is affected by a security bypass vulnerability due to a failure to check the refusal deadline during the forwarding of untrusted X11 connections. A remote attacker can exploit this to bypass timeout checks and XSECURITY restrictions. %NASLMINLEVEL...

Amazon Linux: Security Advisory (ALAS-2015-568)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 21 : openssh-6.6.1p1-13.fc21 (2015-11067)

This update brings security fix for two announced vulnerabilities. Namely XSECURITY restrictions bypass under certain conditions AND weakness of agent locking ssh-add -x to password guessing more info in related bugs. For more information see related bugs. Note that Tenable Network Security has...

Fedora 22 : openssh-6.9p1-1.fc22 (2015-11063)

This update brings security fix for two announced vulnerabilities. Namely XSECURITY restrictions bypass under certain conditions AND weakness of agent locking ssh-add -x to password guessing more info in related bugs. It also provides new version of openssh-6.9 which is bringing many bugfixes and...

Updated openssh package fixes security vulnerability

In Portable OpenSSH before 6.9p1, when forwarding X11 connections with ForwardX11Trusted=no, connections made after ForwardX11Timeout expired could be permitted and no longer subject to XSECURITY restrictions because of an ineffective timeout check in ssh CVE-2015-5352...

openssh: XSECURITY restrictions bypass

When forwarding X11 connections with ForwardX11Trusted=no, connections made after ForwardX11Timeout expired could be permitted and no longer subject to XSECURITY restrictions because of an ineffective timeout check in ssh coupled with "fail open" behaviour in the X11 server when clients attempted...