Mozilla Network Security Service (NSS): Multiple vulnerabilities

Background The Mozilla Network Security Service NSS is a library implementing security features like SSL v.2/v.3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME and X.509 certificates. Description Multiple vulnerabilities have been discovered in NSS. Please review the CVE identifiers referenced...

OSSEC: Multiple vulnerabilities

Background OSSEC is a full platform to monitor and control your systems. Description Multiple vulnerabilities have been discovered in OSSEC. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no know...

sysstat: Arbitrary code execution

Background sysstat is a package containing a number of performance monitoring utilities for Linux, including sar, mpstat, iostat and sa tools. Description A double-free in sysstat’s checkfileactlst function was discovered. Impact A local attacker could possibly execute arbitrary code with the...

Apache Tomcat: Remote code execution

Background Apache Tomcat is a Servlet-3.0/JSP-2.2 Container. Description Apache Tomcat improperly handles deserialization of files under specific circumstances. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service conditio...

Nokogiri: Command injection

Background Nokogiri is an HTML, XML, SAX, and Reader parser. Description A command injection vulnerability in Nokogiri allows commands to be executed in a subprocess by Ruby’s Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizerloadfile is being...

GPL Ghostscript: Multiple vulnerabilities

Background Ghostscript is an interpreter for the PostScript language and for PDF. Description Multiple vulnerabilities have been discovered in GPL Ghostscript. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to process a specially craft...

QtCore: Multiple vulnerabilities

Background The Qt toolkit is a comprehensive C++ application development framework. Description Multiple vulnerabilities have been discovered in QtCore. Please review the CVE identifiers referenced below for details. Impact An attacker could possibly execute arbitrary code with the privileges of...

LibVNCServer: Multiple vulnerabilities

Background LibVNCServer/LibVNCClient are cross-platform C libraries that allow you to easily implement VNC server or client functionality in your program. Description Multiple vulnerabilities have been discovered in LibVNCServer. Please review the CVE identifiers referenced below for details...

Supervisor: command injection vulnerability

Background Supervisor is a client/server system that allows its users to monitor and control a number of processes on UNIX-like operating systems. Description A vulnerability in Supervisor was discovered in which an authenticated client could send malicious XML-RPC requests and supervidord will r...

GNU C Library: Multiple vulnerabilities

Background The GNU C library is the standard C library used by Gentoo Linux systems. Description Multiple vulnerabilities have been discovered in the GNU C Library. Please review the CVE identifiers and Qualys’ security advisory referenced below for details. Impact An attacker could possibly...

QEMU: Multiple vulnerabilities

Background QEMU is a generic and open source machine emulator and virtualizer. Description Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details. Impact A local attacker could potentially execute arbitrary code with privileges of QEM...

HarfBuzz: Multiple vulnerabilities

Background HarfBuzz is an OpenType text shaping engine. Description Multiple vulnerabilities have been discovered in HarfBuzz. Please review the CVE identifiers referenced below for details. Impact Remote attackers, through the use of crafted data, could cause a Denial of Service condition or hav...

Chromium: Multiple vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Description Multiple vulnerabilities have been discovered in the Chromium web browser. Please review the CVE identifiers referenced below for details...

NTFS-3G: Privilege escalation

Background NTFS-3G is a stable, full-featured, read-write NTFS driver for various operating systems. Description NTFS-3G is affected by the same vulnerability as reported in “GLSA 201603-04” when the bundled fuse-lite implementation is used. Impact A local user could gain root privileges...

Samba: Multiple vulnerabilities

Background Samba is a suite of SMB and CIFS client/server programs. Description Multiple vulnerabilities have been discovered in samba. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with root privileges, cause a Deni...

Chromium: Multiple vulnerabilities

Background Chromium is an open-source web browser project. Description Multiple vulnerabilities have been discovered in Chromium. Please review the CVE identifiers referenced below for details. Impact A remote attacker may be able to cause a Denial of Service condition, gain privileges via a...

PHP: Multiple vulnerabilities

Background PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. Description Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact A...

Oracle JRE/JDK: Multiple vulnerabilities

Background The Oracle Java Development Kit JDK formerly known as Sun JDK and the Oracle Java Runtime Environment JRE formerly known as Sun JRE provide the Oracle Java platform formerly known as Sun Java Platform. Description Multiple vulnerabilities have been reported in the Oracle Java...

PHP: Multiple vulnerabilities

Background PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. Description Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below and the associated PHP release notes...

Ruby: Multiple vulnerabilities

Background Ruby is an interpreted object-oriented programming language. The elaborate standard library includes an HTTP server "WEBRick" and a class for XML parsing "REXML". Description Multiple vulnerabilities have been discovered in the Ruby interpreter and its standard libraries. Drew Yao of...

Mantis: Multiple vulnerabilities

Background Mantis is a PHP/MySQL/Web based bugtracking system. Description Antonio Parata and Francesco Ongaro reported a Cross-Site Request Forgery vulnerability in manageusercreate.php CVE-2008-2276, a Cross-Site Scripting vulnerability in returndynamicfilters.php CVE-2008-3331, and an...

Ruby on Rails: Multiple vulnerabilities

Background Ruby on Rails is a free web framework used to develop database-driven web applications. Description candlerb found that ActiveResource, when processing responses using the Hash.fromxml function, does not properly sanitize filenames CVE-2007-5380. The session management functionality...

glibc: Multiple Vulnerabilities

Background glibc is a package that contains the GNU C library. Description Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workarou...

HTMLDOC: Multiple Vulnerabilities

Background HTMLDOC is a HTML indexer and HTML to PS and PDF converter. Description Multiple vulnerabilities have been discovered in HTMLDOC. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no know...

MediaWiki: Multiple Vulnerabilities

Background MediaWiki is a collaborative editing software, used by big projects like Wikipedia. Description Multiple vulnerabilities have been discovered in MediaWiki. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Oracle VirtualBox: Multiple Vulnerabilities

Background VirtualBox is a powerful virtualization product from Oracle. Description Multiple vulnerabilities have been discovered in Oracle VirtualBox. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There...

HashiCorp Consul: Multiple Vulnerabilities

Background HashiCorp Consul is a tool for service discovery, monitoring and configuration. Description Multiple vulnerabilities have been discovered in HashiCorp Consul. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Apache Thrift: Multiple vulnerabilities

Background Apache Thrift is a software framework that combines a software stack with a code generation engine to build services that work efficiently and seamlessly between many languages. Description Multiple vulnerabilities have been discovered in Apache Thrift. Please review the CVE identifier...

Ark: Symlink vulnerability

Background Ark is a graphical file compression/decompression utility with support for multiple formats. Description KDE Ark did not fully verify symlinks contained within tar archives. Impact A remote attacker could entice a user to open a specially crafted tar archive using KDE Ark, possibly...

fuseiso: Multiple vulnerabilities

Background FuseISO is a FUSE module to mount ISO filesystem images .iso, .nrg, .bin, .mdf and .img files. Description Multiple vulnerabilities have been discovered in fuseiso. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a...

ssvnc: Multiple vulnerabilities

Background The Enhanced TightVNC Viewer, SSVNC, adds encryption security to VNC connections. Description Multiple vulnerabilities have been discovered in ssvnc. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Cacti: Multiple vulnerabilities

Background Cacti is a complete frontend to rrdtool. Description Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details. Impact Remote attackers could execute arbitrary code or bypass intended access restrictions. Workaround There is ...

Vim, gVim: Remote execution of arbitrary code

Background Vim is an efficient, highly configurable improved version of the classic ‘vi’ text editor. gVim is the GUI version of Vim. Description It was found that the :source! command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text fil...

Kodi: Multiple vulnerabilities

Background Kodi formerly XBMC is a free and open-source media player software application. Description Multiple vulnerabilities have been discovered in Kodi. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a specially crafted...

VirtualBox: Multiple vulnerabilities

Background VirtualBox is a powerful virtualization product from Oracle. Description Multiple vulnerabilities have been discovered in VirtualBox. Please review the CVE identifiers referenced below for details. Impact An attacker could cause a Denial of Service condition. Additionally, an attacker...

Dropbear: Privilege escalation

Background Dropbear is a relatively small SSH server and client. Description A CRLF injection vulnerability in Dropbear SSH allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data. Impact A remote authenticated user could execute arbitrary...

Mozilla Products: Multiple vulnerabilities

Background Mozilla Firefox is an open-source web browser, Mozilla Thunderbird an open-source email client, and the Network Security Service NSS is a library implementing security features like SSL v.2/v.3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME and X.509 certificates. The SeaMonkey project...

Oracle JRE/JDK: Multiple vulnerabilities

Background Oracle’s Java SE Development Kit and Runtime Environment Description Multiple vulnerabilities have been discovered in Oracle’s Java SE Development Kit and Runtime Environment. Please review the CVE identifiers referenced below for details. Impact A context-dependent attacker may be abl...

Multiple packages, Multiple vulnerabilities fixed in 2010

Background For more information on the packages listed in this GLSA, please see their homepage referenced in the ebuild. Description Vulnerabilities have been discovered in the packages listed below. Please review the CVE identifiers in the Reference section for details. Insight Perl Tk Module...

Libav: Multiple vulnerabilities

Background Libav is a complete solution to record, convert and stream audio and video. Description Multiple vulnerabilities have been discovered in Libav. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a specially crafted media...

nbd: Multiple vulnerabilities

Background nbd is a userland client/server for kernel network block device. Description Multiple vulnerabilities have been discovered in nbd. Please review the CVE identifiers referenced below for details. Impact nbd allows remote attackers to cause a denial of service NULL pointer dereference an...

BIND: Cache poisoning

Background ISC BIND is the Internet Systems Consortium implementation of the Domain Name System DNS protocol. Description Dan Kaminsky of IOActive has reported a weakness in the DNS protocol related to insufficient randomness of DNS transaction IDs and query source ports. Impact An attacker could...

OpenSSH: Privilege escalation

Background OpenSSH is a complete SSH protocol implementation that includes an SFTP client and server support. Description Two issues have been discovered in OpenSSH: Timo Juhani Lindfors discovered that OpenSSH sets the DISPLAY variable in SSH sessions using X11 forwarding even when it cannot bin...

ClamAV: Multiple Vulnerabilities

Background ClamAV is a GPL virus scanner. Description Multiple vulnerabilities have been discovered in ClamAV. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround at this time...

xterm: Multiple Vulnerabilities

Background xterm is a terminal emulator for the X Window system. Description Multiple vulnerabilities have been discovered in xterm. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

GPT fdisk: Integer underflow

Background GPT fdisk consisting of the gdisk, cgdisk, sgdisk, and fixparts programs is a set of text-mode partitioning tools for Linux, FreeBSD, Mac OS X, and Windows. Description It was discovered that ReadLogicalParts function in basicmbr.cc was missing a bounds check. Impact A local attacker...

WebkitGTK+: Multiple vulnerabilities

Background WebKitGTK+ is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. Description Multiple vulnerabilities have been discovered in WebkitGTK+. Please review the CVE...

phpMyAdmin: Multiple vulnerabilities

Background phpMyAdmin is a web-based management tool for MySQL databases. Description Multiple vulnerabilities have been discovered in phpMyAdmin. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is n...

Dropbear: Multiple vulnerabilities

Background Dropbear is an SSH server and client designed with a small memory footprint. Description Multiple vulnerabilities have been discovered in Dropbear. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaroun...

re2c: Buffer overflow

Background re2c is a tool for generating C-based recognizers from regular expressions. Description A heap buffer overflow vulnerability was discovered in re2c. Impact An attacker could possibly cause a Denial of Service condition. Workaround There is no known workaround at this time. Resolution A...