[SECURITY] [DSA 2481-1] arpwatch security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2481-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez June 2, 2012 http://www.debian.org/security/faq -...

ZDI-12-093 : (Pwn2Own) Microsoft Internet Explorer Fixed Table Colspan Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-093 : Pwn2Own Microsoft Internet Explorer Fixed Table Colspan Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-093 June 12, 2012 - -- CVE ID: CVE-2012-1876 - -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C - --...

[SECURITY] [DSA 2494-1] ffmpeg security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2494-1 [email protected] http://www.debian.org/security/ Florian Weimer June 14, 2012 http://www.debian.org/security/faq -...

[CAL-2012-0026] Microsfot IE Same ID Property Remote Code Execution Vulnerability

CAL-2012-0026 Microsfot IE Same ID Property Remote Code Execution Vulnerability CVE ID: CVE-2012-1875 http://technet.microsoft.com/en-us/security/bulletin/ms12-037 http://blog.vulnhunt.com/index.php/2012/06/13/cal-2012-0026-microsfot-ie-same-id-property-remote-code-execution-vulnerability/ 1...

[SE-2012-01] Regarding Oracle's Critical Patch Update for Java SE

Dear All, Yesterday, Oracle released its Critical Patch Update for Java SE software 1, which incorporates fixes for 3 of more than 20+ security issues that were reported to the company in Apr 2012 2. We would like to inform, that while some of the Proof of Concept codes we developed for the...

Opera URL spoof

It's possible to trace event when user leaves the site and to spoof site content...

CSNC-2012-004 Generic XSS in AdNovum nevisProxy

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: NevisProxy Vendor: AdNovum CVD ID: CSNC-2012-004 Subject: Cross-site scripting XSS within 302 Redirections Risk: High Effect: Remotely exploitable Author: Alexandre Herzog [email protected] Date: 02/23/2012...

F5 BIG-IP authentication bypass

Full device acces is possible...

[ MDVSA-2012:087 ] nut

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2012:087 http://www.mandriva.com/security/ Package : nut Date : June 5, 2012 Affected: 2010.1, 2011., Enterprise Server 5.0 Problem Description: A vulnerability has been discovered and corrected in nut: Buffer...

AST-2012-009: Skinny Channel Driver Remote Crash Vulnerability

Asterisk Project Security Advisory - AST-2012-009 Product Asterisk Summary Skinny Channel Driver Remote Crash Vulnerability Nature of Advisory Denial of Service Susceptibility Remote authenticated sessions Severity Minor Exploits Known No Reported On May 30, 2012 Reported By Christoph Hebeisen,...

Sielco Sistemi Winlog Buffer Overflow <= v2.07.14

!/usr/bin/ruby --------------------------------------------- Sielco Sistemi Winlog Buffer Overflow = v2.07.14 - Buffer overflow vulnerability Date: 04.06.2012 --------------------------------------------- - Description Winlog Lite is the entry level version of the SCADA/HMI software Winlog Pro...

Sielco Sistemi Winlog buffer overflow

Buffer overflow on TCP/46824 traffic parsing...

[security bulletin] HPSBMU02790 SSRT100872 rev.1 - HP Server Automation, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03366886 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03366886 Version: 1 HPSBMU02790...

arpwatch protection bypass

Elevated privileges are dropped incorrectly...

CVE-2012-1661 - ESRI ArcMap arbitrary code execution via crafted map file.

Description: Opening a specially crafted mxd file will execute arbitrary code without prompting and without a crash of the application. This is due to a flaw in the programs ability to prompt a user before executing embedded VBA. Mxd files are not filtered by email systems so this allows a remote...

AdNovum NevisWeb Security Proxy Vulnerability - Cross-site scripting (XSS) within 302 Redirections

Hi all, nevisProxy is a Swiss secure reverse proxy with integrated web application firewall WAF. It acts as a central upstream entry point for web traffic to integrated online applications. nevisProxy controls user access and protects sensitive data, applications, services, and systems from...

IObit Protected Folder Authentication Bypass

From IObit: "Protected Folder is designed to password-protect your folders and files from being seen, read or modified in Windows 7, Vista, XP and Server 2008, 2003. It works like a safety box, just drag and drop the folders or files you want to hide or protect into Protected Folder, then no one...

[CAL-2012-0015] opera website spoof

CAL-2012-0015 opera website spoof CVE ID: Opera did not assign ,please [email protected] assign CAL ID: CAL-2012-0015 ref: http://blog.vulnhunt.com/index.php/2012/06/14/cal-2012-0015-opera-website-spoof/ 1 Affected Products ================= 11.61 and prior 2 Vulnerability Details ===================...

IObit Protected Folder protection bypass

It's possible to bypass protection, e.g. by changing return value of password checking function...

Security Advisory - Checkpoint Endpoint Connect VPN - DLL Hijack

Security Advisory - Checkpoint Endpoint Connect VPN - DLL Hijack ================================================================================ Summary : Checkpoint Endpoint Connect VPN is prone to DLL hijacking Date : 12 June 2012 Affected versions : Endpoint Security VPN R75 Remote Access...

ZDI-12-088 : HP DataDirect OpenAccess GIOP Opcode 0x0E Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-088 : HP DataDirect OpenAccess GIOP Opcode 0x0E Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-088 June 6, 2012 - -- CVE ID: CVE-2011-4163 - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors:...

ESRI ArcMap code execution

MXD files may contain VBS scripts...

[security bulletin] HPSBMU02776 SSRT100852 rev.1 - HP Onboard Administrator (OA), Remote Unauthorized Access to Data, Unauthorized Disclosure of Information Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03315912 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03315912 Version: 1 HPSBMU02776...

Secunia Research: Network Instruments Observer SNMP OID Processing Denial of Service

====================================================================== Secunia Research 07/06/2012 - Network Instruments Observer - - SNMP OID Processing Denial of Service Vulnerability - ====================================================================== Table of Contents Affected...

IIS 6.0/7.5 Vulnerabilities [moderate risk] - ISOWAREZ BDAY RELEASE

THIS IS A GENUINE ISOWAREZ RELEASE ------------------------------------------------------------------------------------------------------------------------------------------------------------ Title: Microsoft IIS 6.0 with PHP installed Authentication Bypass Affected software: Microsoft IIS 6.0 wi...

Secunia Research: Network Instruments Observer SNMP Processing Buffer Overflows

====================================================================== Secunia Research 07/06/2012 - Network Instruments Observer - - SNMP Processing Buffer Overflows - ====================================================================== Table of Contents Affected...

ZDI-12-081 : Oracle Java GlueGen Arbitrary Native Library Loading Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-081 : Oracle Java GlueGen Arbitrary Native Library Loading Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-081 June 6, 2012 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Oracle - --...

ZDI-12-083 : Oracle Java OpenAL Library Pointer Manipulation Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-083 : Oracle Java OpenAL Library Pointer Manipulation Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-083 June 6, 2012 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Oracle - -- Affected...

ZDI-12-091 : Symantec Web Gateway upload_file Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-091 : Symantec Web Gateway uploadfile Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-091 June 8, 2012 - -- CVE ID: CVE-2012-0299 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Symantec ...

Microsoft Dynamics AX crossite scripting

Crossite scripting via URLs...

RealNetworks RealPlayer multiple security vulnerabilities

Multiple vulnerabilities on different sofrmats parsing...

ZDI-12-092 : RealNetworks RealPlayer QCELP Stream Parsing Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-092 : RealNetworks RealPlayer QCELP Stream Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-092 June 8, 2012 - -- CVE ID: CVE-2011-4247 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected...

ZDI-12-077 : Apple QuickTime QTVR QTVRStringAtom Parsing Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-077 : Apple QuickTime QTVR QTVRStringAtom Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-077 June 6, 2012 - -- CVE ID: CVE-2012-0667 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendor...

[SECURITY] [DSA 2491-1] postgresql-8.4 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2491-1 [email protected] http://www.debian.org/security/ Florian Weimer June 09, 2012 http://www.debian.org/security/faq -...

PostgreSQL security vulnerabilities

DoS, weak crypt implementation...

ISC bind DoS

Crash on zero length RADTA processing...

Microsoft Remote Desktop memory corruption

Memory corruption on RDP packets processing...

[SECURITY] [DSA 2492-1] php5 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2492-1 [email protected] http://www.debian.org/security/ Florian Weimer June 10, 2012 http://www.debian.org/security/faq -...

Mictosoft Lync multiple security vulnerabilities

Font parsing vulnerabilities, unsafe DLL loading, crossite scripting...

Symantec WebGateway security vulnerabilities

Code execution, unfiltered shell characters...

Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Buffer overflows, memory corruptions, use-after-free, code executions, privilege escalations...

PHP buffer overflow

Buffer overflow on tar files processing...

ZDI-12-075 : Apple Quicktime RLE Sample Decoding Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-075 : Apple Quicktime RLE Sample Decoding Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-075 June 6, 2012 - -- CVE ID: CVE-2012-0668 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Apple...

ZDI-12-078 : Apple QuickTime SVQ3 Codec mb_skip_run Parsing Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-078 : Apple QuickTime SVQ3 Codec mbskiprun Parsing Remote Code Execution http://www.zerodayinitiative.com/advisories/ZDI-12-078 June 6, 2012 - -- CVE ID: CVE-2012-0669 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Apple - --...

[php<=5.4.3] Parsing Bug in PHP PDO prepared statements may lead to access violation

php=5.4.3 Parsing Bug in PHP PDO prepared statements may lead to access violation Affected Product: PHP Affected Component: PDO - PHP Data Objects Affected Versions: =5.4.3 latest version and trunk PHP Bug Ref: 61755 Patch: bug61755.diff Discovery Date: Feb...

ZDI-12-080 : Adobe Flash Player MP4 Stream Decoding Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-080 : Adobe Flash Player MP4 Stream Decoding Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-080 June 6, 2012 - -- CVE ID: CVE-2012-0754 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors:...

Microsoft IIS protection bypass

Password protection bypass, script files content access...

ZDI-12-079 : Apple QuickTime H264 Picture Width Parsing Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-079 : Apple QuickTime H264 Picture Width Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-079 June 6, 2012 - -- CVE ID: CVE-2012-0665 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors...

PHP PDO out-of-boundaures access

Out-of-bounds access via precompiled database request...

ZDI-12-084 : RealNetworks RealPlayer RV10 Encoded Height/Width Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-084 : RealNetworks RealPlayer RV10 Encoded Height/Width Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-084 June 6, 2012 - -- CVE ID: CVE-2012-0926 - -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C - -- Affected...