[SECURITY] [DSA 3102-1] libyaml security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3102-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso December 13, 2014 http://www.debian.org/security/faq -...

Apple Xcode git client unauthorized files access

Invali processing of characters case in special files names...

GParted code execution

Commands injections...

[oCERT-2014-012] JasPer input sanitization errors

2014-012 JasPer input sanitization errors Description: The JasPer project is an open source implementation for the JPEG-2000 codec. The library is affected by a double-free vulnerability in function jasiccattrvaldestroy as well as a heap-based buffer overflow in function jp2decode. A specially...

secuvera-SA-2014-01: Reflected XSS in W3 Total Cache

secuvera-SA-2014-01: Reflected XSS in W3 Total Cache Affected Products W3 Total Cache 0.9.4 older releases have not been tested "The only WordPress Performance Optimization WPO framework; designed to improve user experience and page speed. .. W3 Total Cache improves the user experience of your si...

HP OpenVMS POP3 DoS

No description provided...

c-icap DoS

Few different DoS conditions...

[SECURITY] [DSA 3101-1] c-icap security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3101-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso December 13, 2014 http://www.debian.org/security/faq -...

SAP applications multiple security vulnerabilities

Unauthorized access, crossite scripting, backdoor account, authentication bypass, unencrypted password transfer...

Docker multiple security vulnerabilities

Symbolic links vulnerability, directory traversal, privilege escalation...

CVE-2014-9215 - SQL Injection in PBBoard CMS

Vulnerability title: SQL Injection in PBBoard CMS CVE: CVE-2014-9215 CMS: PBBoard Vendor: Power bulletin board - http://www.pbboard.info/ Product: http://sourceforge.net/projects/pbboard/files/PBBoardv3.0.1/PBBoardv3.0.1.zip/download Affected version: Version 3.0.1 updated on 13/09/2014 and befor...

[ MDVSA-2014:253 ] apache-mod_wsgi

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:253 http://www.mandriva.com/en/support/security/ Package : apache-modwsgi Date : December 15, 2014 Affected: Business Server 1.0 Problem Description: Updated apache-modwsgi package fixes security...

CA LISA Release Automation multiple security vulnerabilities

XSS, CSRF, SQL injection...

SEC Consult SA-20141218-1 :: OS command execution vulnerability in GParted

SEC Consult Vulnerability Lab Security Advisory 20141218-1 ======================================================================= title: OS Command Execution product: GParted - Gnome Partition Editor vulnerable version: =0.14.1 fixed version: =0.15.0, =0.14.1 with fix for CVE-2014-7208 applied C...

[ MDVSA-2014:252 ] nss

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:252 http://www.mandriva.com/en/support/security/ Package : nss Date : December 15, 2014 Affected: Business Server 1.0 Problem Description: Updated nss packages fix security vulnerabilities: In the QuickDER...

Mozilla nss information leakage

Information leakage in QuickDER decoder...

Morfy CMS v1.05 - Command Execution Vulnerability

Document Title: =============== Morfy CMS v1.05 - Command Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1367 https://github.com/Awilum/monstra-cms/issues/351 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9185 CVE-ID:...

RPM security vulnerabilities

Integer oveflow, code execution...

[ MDVSA-2014:251 ] rpm

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:251 http://www.mandriva.com/en/support/security/ Package : rpm Date : December 14, 2014 Affected: Business Server 1.0 Problem Description: Updated rpm packages fix security vulnerabilities: It was found that...

Concrete5 CMS Reflected Cross-Site Scripting Vulnerabilities

Title: Concrete5 CMS Reflected Cross-Site Scripting Vulnerabilities Author: Simo Ben youssef Contact: SimoatMorxploitcom Discovered: 02 November 2014 Updated: 9 December 2014 Published: 9 December 2014 MorXploit Research http://www.MorXploit.com Vendor: Concrete5 Vendor url: www.concrete5.org...

Apple iOS multiple security vulnerabilities

Information leakage, unsigned code execution, code execution, restrictions bypass, memory corruption...

Apple Safari / Webkit multiple security vulnerabilities

Multiple memory corruptions...

Apple iOS v8.x - Message Context & Privacy Vulnerability

Document Title: =============== Apple iOS v8.x - Message Context & Privacy Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1346 Video: http://www.vulnerability-lab.com/getcontent.php?id=1350 Release Date: ============= 2014-12-16...

APPLE-SA-2014-12-11-1 Safari 8.0.2, Safari 7.1.2, and Safari 6.2.2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2014-12-11-1 Safari 8.0.2, Safari 7.1.2, and Safari 6.2.2 Safari 8.0.2, Safari 7.1.2, and Safari 6.2.2 are now available and include the security content of Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1: https://support.apple.com/en-us/HT659...

[USN-2441-1] Linux kernel vulnerabilities

========================================================================== Ubuntu Security Notice USN-2441-1 December 12, 2014 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Linux kernel multiple security vulnerabilities

DoS via SCTP, TechnoTrend/Hauppauge DEC USB driver buffer overflow, invalid registers handling in x86, ASLR bypass...

VMWare AirWatch information disclosure

It's possible to access information of different tenant...

[USN-2438-1] NVIDIA graphics drivers vulnerabilities

========================================================================== Ubuntu Security Notice USN-2438-1 December 10, 2014 nvidia-graphics-drivers-304, nvidia-graphics-drivers-304-updates, nvidia-graphics-drivers-331, nvidia-graphics-drivers-331-updates vulnerabilities...

Offset2lib: bypassing full ASLR on 64bit Linux

Hi, This is a disclosure of a weakness of the ASLR Linux implementation. The problem appears when the executable is PIE compiled and it has an address leak belonging to the executable. We named this weakness: offset2lib. In this scenario, an attacker is able to de-randomize all mmapped areas...

[oss-security] PowerDNS Security Advisory 2014-02

Hi everybody, Please be aware of PowerDNS Security Advisory 2014-02 http://doc.powerdns.com/md/security/powerdns-advisory-2014-02/, which you can also find below. The good news is that the currently released version of the PowerDNS Recursor is safe. The bad news is that users of older versions wi...

Asterisk DoS

WebSocket Server request parsing DoS...

SGI Tempo multiple security vulnerabilities

Privilege escalation, information leakage...

PowerDNS Recursor DoS

Resources exhaustion...

HP Smart Update Manager information disclosure

No description provided...

[CVE-2014-7302] SGI SUID Root Privilege Escalation

SGI SUID Root Privilege Escalation Software: SGI Tempo SGI ICE-X Supercomputers Affected Versions: Unknown CVE Reference: CVE-2014-7302 Author: Luke Jennings, John Fitzpatrick, MWR Labs Severity: Medium Risk Vendor: Silicon Graphics International Corp SGI Vendor Response: Uncooperative Descriptio...

APPLE-SA-2014-12-2-1 Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2014-12-3-1 Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1 Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1 is now available and addresses the following: WebKit Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite...

[CVE-2014-7301] SGI Tempo System Database Password Exposure

SGI Tempo System Database Password Exposure Software: SGI Tempo SGI ICE-X Supercomputers Affected Versions: Unknown CVE Reference: CVE-2014-7301 Author: John Fitzpatrick, MWR Labs Severity: Medium Risk Vendor: Silicon Graphics International Corp SGI Vendor Response: Uncooperative Description It i...

[CVE-2014-7303] SGI Tempo System Database Exposure

SGI Tempo System Database Exposure Software: SGI Tempo SGI ICE-X Supercomputers Affected Versions: Unknown CVE Reference: CVE-2014-7303 Author: John Fitzpatrick, MWR Labs Severity: Low Risk Vendor: Silicon Graphics International Corp SGI Vendor Response: Uncooperative Description It is possible f...

[SECURITY] [DSA 3097-1] unbound security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3097-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez December 10, 2014 http://www.debian.org/security/faq -...

[security bulletin] HPSBMU03043 rev.1 - HP Smart Update Manager for Windows and Linux, Local Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04302476 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04302476 Version: 1 HPSBMU03043 rev....

unbound DoS

Resources exhaustion on recursive requests handling...

VMware vSphere multiple security vulnerabilities

Crossite scripting, certificate validation issues, vulnerabilities in 3rd party packages...

NEW VMSA-2014-0014 - AirWatch by VMware product update addresses information disclosure vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2014-0014 Synopsis: AirWatch by VMware product update addresses information disclosure vulnerabilities Issue date: 2014-12-10 Updated...

[USN-2436-1] X.Org X server vulnerabilities

========================================================================== Ubuntu Security Notice USN-2436-1 December 09, 2014 xorg-server, xorg-server-lts-trusty vulnerabilities ========================================================================== A security issue affects these releases of...

X.Org X server and video drivers multiple security vulnerabilities

Multiple memory corruptions and privilege escalations...

NEW VMSA-2014-0013 - VMware vCloud Automation Center product updates address a critical remote privilege escalation vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2014-0013 Synopsis: VMware vCloud Automation Center product updates address a critical remote privilege escalation vulnerability Issu...

[SECURITY] [DSA 3096-1] pdns-recursor security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3096-1 [email protected] http://www.debian.org/security/ Sebastien Delafond December 11, 2014 http://www.debian.org/security/faq -...

AST-2014-019: Remote Crash Vulnerability in WebSocket Server

Asterisk Project Security Advisory - AST-2014-019 Product Asterisk Summary Remote Crash Vulnerability in WebSocket Server Nature of Advisory Denial of Service Susceptibility Remote Unauthenticated Sessions Severity Moderate Exploits Known No Reported On 30 October 2014 Reported By Badalian...

[USN-2435-1] Graphviz vulnerability

========================================================================== Ubuntu Security Notice USN-2435-1 December 09, 2014 graphviz vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

graphviz memory corruption

Format string vulnerability on graphics format parsing...