908 matches found
BSA-2017-223
Security Advisory ID : BSA-2017-223 Component : ntp Revision : 1.0: Interim Zero Origin timestamp problems were fixed by Bug 2945 in ntp-4.2.8p6. However, subsequent timestamp validation checks introduced a regression in the handling of some Zero origin timestamp checks. Affected Products Product...
BSA-2017-214
Security Advisory ID : BSA-2017-214 Component : wget Revision : 1.0: Interim Race condition inwget1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open. Affect...
BSA-2017-226
Security Advisory ID : BSA-2017-226 Component : ntp Revision : 1.0: Interim The broadcast mode of NTP is expected to only be used in a trusted network. If the broadcast network is accessible to an attacker, a potentially exploitable denial of service vulnerability inntpd'sbroadcast mode poll...
BSA-2017-216
Security Advisory ID : BSA-2017-216 Component : libcurl Revision : 1.0: Interim curl andlibcurlbefore 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loade...
BSA-2017-215
Security Advisory ID : BSA-2017-215 Component : sqlite Revision : 3.0: Final osunix.cin SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service application crash, or have...
BSA-2017-212
Security Advisory ID : BSA-2017-212 Component : libidn Revision : 2.0: Final The stringpreputf8nfkcnormalize function in lib/nfkc.cinlibidnbefore 1.33 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via crafted UTF-8 data...
BSA-2017-213
Security Advisory ID : BSA-2017-213 Component : libidn Revision : 2.0: Final idninlibidnbefore 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948...
BSA-2017-205
Security Advisory ID : BSA-2017-205 Component : OpenSSL Revision : 1.0: Interim Severity: High-TLS connections using -CHACHA20-POLY1305ciphersuitesare susceptible to aDoSattack by corrupting larger payloads. This can result in an OpenSSL crash. Thisissue is not considered to be exploitable beyond...
BSA-2017-206
Security Advisory ID : BSA-2017-206 Component : OpenSSL Revision : 1.0: Interim Severity: Moderate-Applications parsing invalid CMS structures can crash with a NULL pointerdereference. This is caused by a bug in the handling of the ASN.1 CHOICE typein OpenSSL 1.1.0 which can result in a NULL valu...
BSA-2017-218
Security Advisory ID : BSA-2017-218 Component : ntp Revision : 1.0: Interim tpddoes not enable trap service by default. If trap service has been explicitly enabled, an attacker can send a specially crafted packet to cause a null pointer dereference that will crashntpd, resulting in a denial of...
BSA-2017-220
Security Advisory ID : BSA-2017-220 Component : ntp Revision : 1.0: Interim The broadcast mode of NTP is expected to only be used in a trusted network. If the broadcast network is accessible to an attacker, a potentially exploitable denial of service vulnerability inntpd'sbroadcast mode replay...
BSA-2017-227
Security Advisory ID : BSA-2017-227 Component : ntp Revision : 1.0: Interim Bug 2085 described a condition where the root delay was included twice, causing the jitter value to be higher than expected. Due to a misinterpretation of a small-print variable in The Book, the fix for this problem was...
BSA-2017-219
Security Advisory ID : BSA-2017-219 Component : ntp Revision : 1.0: Interim An exploitable configuration modification vulnerability exists in the control mode mode 6 functionality ofntpd. If, against long-standing BCP recommendations, "restrict defaultnoquery..." is not specified, a specially...
BSA-2017-207
Security Advisory ID : BSA-2017-207 Component : OpenSSL Revision : 1.0: Interim Severity: Low-There is a carry propagating bug in the Broadwell-specific Montgomerymultiplication procedure that handles input lengths divisible by, butlonger than 256 bits. Analysis suggests that attacks against RSA,...
BSA-2017-211
Security Advisory ID : BSA-2017-211 Component : libidn Revision : 1.0: Interim The idnatoascii4i function in lib/idna.cinlibidnbefore 1.33 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via 64 bytes of input. Affected Products Product| Current...
BSA-2017-225
Security Advisory ID : BSA-2017-225 Component : ntp Revision : 1.0: Interim Whenntpdreceives a server response on a socket that corresponds to a different interface than was used for the request, the peer structure is updated to use the interface for new requests. Ifntpdis running on a host with...
BSA-2017-204
Security Advisory ID : BSA-2017-204 Component : Linux Kernel Revision : 1.0: Interim Xen and the Linux kernel through 4.5.x do not properly suppresshugetlbfssupport in x86 PV guests, which allows local PV guest OS users to cause a denial of service guest OS crash by attempting to access...
BSA-2017-201
Security Advisory ID : BSA-2017-201 Component : OpenSSL Revision : 1.0: Interim It was found that function "ssl3readbytes" inssl/s3pkt.c might lead to higher CPU usage due to improper handling of warning packets.An attacker could repeat the undefined plaintext warning packets of "SSL3ALWARNING"...
BSA-2017-210
Security Advisory ID : BSA-2017-210 Component : libidn Revision : 2.0: Final idnin GNUlibidnbefore 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read...
BSA-2017-234
Security Advisory ID : BSA-2017-234 Component : Linux Kernel Revision : 2.0: Interim Race condition in net/packet/afpacket.cin the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service use-after-free by leveraging the CAPNETRAW capability to change a socke...
BSA-2017-115
Security Advisory ID : BSA-2017-115 Component : Apache HTTPD Revision : 2.0: Final The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow...
BSA-2017-501
Security Advisory ID : BSA-2017-501 Component : Apache HTTPD Revision : 2.0: Final In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to modauthdigest can cause the server to crash, and each instance continues to crash even for subsequently valid requests...
BSA-2017-179
Security Advisory ID : BSA-2017-179 Component : BNA Revision : 1.0: Final A Directory Traversal Vulnerability in servletSoftwareImageUploadin the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to write to arbitrary files, and consequently dele...
BSA-2016-209
Security Advisory ID : BSA-2016-209 Component : Web UI Revision : 1.0: Final A CSRF vulnerability in Brocade Virtual Traffic Manager versions released prior to and including 11.0, could allow an attacker to trick a logged-in user into making administrative changes on the traffic manager cluster...
BSA-2017-177
Security Advisory ID : BSA-2017-177 Component : BNA Revision : 1.0: Final A Directory Traversal Vulnerability inFileReceiveServletin the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload malicious file in a section of the file system...
BSA-2017-178
Security Advisory ID : BSA-2017-178 Component : BNA Revision : 1.0: Final A Directory Traversal Vulnerability inDashboardFileReceiveServletin the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload malicious file in a section of the file...
BSA-2017-180
Security Advisory ID : BSA-2017-180 Component : BNA Revision : 1.0: Final A Directory Traversal Vulnerability inCliMonitorReportServletin the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to read arbitrary files including files with sensitive...
BSA-2017-105
Security Advisory ID : BSA-2017-105 Component : Apache HTTPD Revision : 2.0: Final The Apache HTTP Server 2.4.18 through 2.4.20, when modhttp2 and modssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attacker...
BSA-2016-195
Security Advisory ID : BSA-2016-195 Component : OpenSSH Revision : 2.0: Final sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by...
BSA-2016-198
Security Advisory ID : BSA-2016-198 Component : curl/libcurl Revision : 2.0: Final Use-after-free vulnerability inlibcurlbefore 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors...
BSA-2016-182
Security Advisory ID : BSA-2016-182 Component : OpenSSH Revision : 3.0: Final The x11openhelper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypa...
BSA-2016-012
Security Advisory ID : BSA-2016-012 Component : BEA WebLogic Revision : 2.0: Final The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to...
BSA-2016-011
Summary Security Advisory ID : BSA-2016-011 Component : OpenSSL Revision : 6.0 N/A...
BSA-2016-010
Summary Security Advisory ID : BSA-2016-010 Component : Linux Kernel Revision : 5.0 N/A...
BSA-2016-168
Security Advisory ID : BSA-2016-168 Component : NetIron Revision : 2.0: Final A memory corruption in the IPsec code path of BrocadeNetIronOS on Brocade MLXs 5.8.00 through 5.8.00e, 5.9.00 through 5.9.00bd, 6.0.00 and 6.0.00a images could allow attackers to cause a denial of service line card rese...
BSA-2016-009
Summary Security Advisory ID : BSA-2016-009 Component : SSH Revision : 2.0 N/A...
BSA-2016-134
Security Advisory ID : BSA-2016-134 Component : Crypto Revision : 2.0: Final The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to...
BSA-2016-008
Summary Security Advisory ID : BSA-2016-008 Component : RPC Revision : 1.0 N/A...
BSA-2016-007
Summary Security Advisory ID : BSA-2016-007 Component : Kernel Revision : 2.0 N/A...
BSA-2016-015
Security Advisory ID : BSA-2016-015 Component : OpenSSH Revision : 3.0: Final The dosetupenv function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pamenvironment files in user home directories, allows local users to gain...
BSA-2016-019
Security Advisory ID : BSA-2016-019 Component : OpenSSH Revision : 3.0: Final Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the 1...
BSA-2016-1052
Security Advisory ID : BSA-2016-1052 Component : TCP Sequence Number Revision : 4.0: Final A vulnerability was discovered in the Transmission Control Protocol TCP specification RFC 873. TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a...
BSA-2016-004
Summary Security Advisory ID : BSA-2016-004 Component : OpenSSH Revision : 5.0 N/A...
BSA-2016-003
Summary Security Advisory ID : BSA-2016-003 Component : glibc Revision : 1.0 N/A...
BSA-2016-002
Summary Security Advisory ID : BSA-2016-002 Component : Web Server Expect Header XSS Revision : 3.0 N/A...
BSA-2016-001
Summary Security Advisory ID : BSA-2016-001 Component : Java Revision : 2.0 N/A...
BSA-2015-009
Summary Security Advisory ID : BSA-2015-009 Component : Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 Revision : 2.0 N/A...
BSA-2015-008
Summary Security Advisory ID : BSA-2015-008 Component : OpenSSL Revision : 4.0 N/A...