47153 matches found
Yealink VoIP phones security vulnerabilities
Crossite scripting, CRLF injection...
Asterisk multiple security vulnerabilities
DoS, restrictions bypass, code execution...
CVE-2014-3427 CRLF Injection and CVE-2014-3428 XSS Injection in Yealink VoIP Phones
I. ADVISORY CVE-2014-3427 CRLF Injection in Yealink VoIP Phones CVE-2014-3428 XSS vulnerabilities in Yealink VoIP Phones Date published: 06/12/2014 Vendor Contacted: 05/08/2014 II. BACKGROUND Yealink is a manufacturer of VoIP and Video products. To minimize noise read more at:...
Linux syscall auditing DoS
System crash on audited syscall with large number...
CVE-2014-3977 - Privilege Escalation in IBM AIX
Vulnerability title: Privilege Escalation in IBM AIX CVE: CVE-2014-3977 Vendor: IBM Product: AIX Affected version: 6.1.8 and later Fixed version: N/A Reported by: Tim Brown Details: It has been identified that libodm allows privilege escalation via arbitrary file writes with elevated privileges...
[SECURITY] [DSA 2958-1] apt security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2958-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst June 12, 2014 http://www.debian.org/security/faq -...
IBM AIX privilege escalation
libodm insecure files creation...
[oss-security] CVE request: Linux kernel DoS with syscall auditing
Issuing a system call with a random large number will OOPS, depending on configuration. A configuration that will enable this bug is: auditctl -a exit,always -S open No privilege whatsoever is required to trigger the OOPS. It's possible that this can be extended to more than just a DoS -- with so...
[oss-security] Re: CVE request: another path traversal in dpkg-source during unpack
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Another path traversal was discovered The short answer is that bug 746498 is CVE-2014-3864, and bug 749183 is CVE-2014-3865. We can also, first, review the status of the CVEs related to our 1 May 2014 message. The proposed CVE mappings for all four of...
AST-2014-008: Denial of Service in PJSIP Channel Driver Subscriptions
Asterisk Project Security Advisory - AST-2014-008 Product Asterisk Summary Denial of Service in PJSIP Channel Driver Subscriptions Nature of Advisory Denial of Service Susceptibility Remote authenticated sessions Severity Moderate Exploits Known No Reported On 28 May, 2014 Reported By Mark...
apt insufficient certificate validation
Insufficient certificate validation during apt-get source...
AST-2014-007: Exhaustion of Allowed Concurrent HTTP Connections
Asterisk Project Security Advisory - AST-2014-007 Product Asterisk Summary Exhaustion of Allowed Concurrent HTTP Connections Nature of Advisory Denial Of Service Susceptibility Remote Unauthenticated Sessions Severity Moderate Exploits Known No Reported On May 25, 2014 Reported By Richard Mudgett...
Cisco IOS XR DoS
DoS via IPv6 packet...
Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities
Buffer overflows, memory corruptions, clickjacking...
AST-2014-005: Remote Crash in PJSIP Channel Driver's Publish/Subscribe Framework
Asterisk Project Security Advisory - AST-2014-005 Product Asterisk Summary Remote Crash in PJSIP Channel Driver's Publish/Subscribe Framework Nature of Advisory Denial of Service Susceptibility Remote Unauthenticated Sessions Severity Moderate Exploits Known No Reported On March 17, 2014 Reported...
triple-fault when executing from a threaded process
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-14:06.exec Errata Notice The FreeBSD Project Topic: triple-fault when executing from a threaded process Category: core Module: kern Announced: 2014-06-03 Credit...
Google Chrome / Chromium multiple security vulnerabilities
Protection bypass, use-after-free, memory corruptions, integer overflow...
[oss-security] CVE-2014-0476 chkrootkit vulnerability
Hi, Thomas Stangner reported the following chkrootkit vulnerability. We assigned CVE-2014-0476 Cheers, Giuseppe -------- Original Message -------- Subject: Serious chkrootkit vulnerability Date: Sun, 25 May 2014 00:53:00 +0200 From: Thomas Stangner [email protected] Organization: Hetzner...
[oss-security] Linux kernel futex local privilege escalation (CVE-2014-3153)
Hi, This was handled via linux-distros, hence the mandatory oss-security posting. The issue was made public earlier today, and is included in this Debian advisory: https://lists.debian.org/debian-security-announce/2014/msg00130.html --- CVE-2014-3153 Pinkie Pie discovered an issue in the futex...
Linux privilege escalation
ring 0 code execution via futex syscall...
FreeBSD DoS
Race conditions on threads context switching...
Adobe Reader / Acrobat multiple security vulnerabilities
Buffer overflows, memory corruptions, information disclosures, use-after-free...
libav multiple security vulnerabilities
No description provided...
VUPEN Security Research - Adobe Acrobat & Reader XI-X "AcroBroker" Sandbox Bypass (Pwn2Own)
VUPEN Security Research - Adobe Acrobat & Reader XI-X "AcroBroker" Sandbox Bypass Pwn2Own Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- Adobe Acrobat and Reader are the global standards for electronic document sharing. They are used to creat...
mupdf buffer overflow
Buffer overflow on XPS parsing...
[SECURITY] [DSA 2939-1] chromium-browser security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2939-1 [email protected] http://www.debian.org/security/ Michael Gilbert May 31, 2014 http://www.debian.org/security/faq -...
[SECURITY] [DSA 2951-1] mupdf security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2951-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 05, 2014 http://www.debian.org/security/faq -...
[SECURITY] [DSA 2947-1] libav security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2947-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 04, 2014 http://www.debian.org/security/faq -...
chkrootkit privilege escalation
It's possible to execute file from /tmp...
OpenSSL multiple security vulnerabilities
Protection level downgrade attacks, multiple DTLS vulnerabilities, DoS...
[oss-security] FreeBSD Security Advisory FreeBSD-SA-14:13.pam
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:13.pam Security Advisory The FreeBSD Project Topic: Incorrect error handling in PAM policy parser Category: contrib Module: pam Announced: 2014-06-03 Credits...
FreeBSD Security Advisory FreeBSD-SA-14:12.ktrace
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:12.ktrace Security Advisory The FreeBSD Project Topic: ktrace kernel memory disclosure Category: core Module: kern Announced: 2014-06-03 Credits: Jilles...
FreeBSD Security Advisory FreeBSD-SA-14:11.sendmail
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:11.sendmail Security Advisory The FreeBSD Project Topic: sendmail improper close-on-exec flag handling Category: contrib Module: sendmail Announced: 2014-06-...
sendmail file descriptor leakage
File descriptors are not closed on external applications call...
FreeBSD ktrace information leakage
It's possible to obtain kernel memory content...
OpenPAM protection bypass
In some situations policy from valid location may not be loaded...
libvirt XXE vulnerability
No description provided...
Wing FTP Rush insufficient certificate validation
SSL certificate is not validated...
FTP Rush: missing X.509 validation (FTP with TLS)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-002 Product: FTP Rush Vendor: Wing FTP Software Affected Versions: v2.1.8 Tested Versions: v2.1.8 Windows 7 32 bit and Windows 8.1 64 bit Vulnerability Type: X.509 validation Risk Level: Medium Solution Status: Vendor...
JavaMail header injection
It's possible to inject header via setSubject...
[ MDVSA-2014:097 ] libvirt
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:097 http://www.mandriva.com/en/support/security/ Package : libvirt Date : May 16, 2014 Affected: Business Server 1.0 Problem Description: Multiple vulnerabilities has been discovered and corrected in libvirt...
JavaMail SMTP Header Injection via method setSubject [CSNC-2014-001]
COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: JavaMail Vendor: Oracle CSNC ID: CSNC-2014-001 CVD ID: none Subject: SMTP Header Injection via method setSubject Risk: Medium Effect: Remotely exploitable Author: Alexandre Herzog [email protected] Date:...
CVE-2014-3450 - Privilege Escalation in Panda Security
Vulnerability title: Privilege Escalation in Panda Security CVE: CVE-2014-3450 Vendor: Panda Product: Security Affected version: See below Fixed version: See below Reported by: Kyriakos Economou Details: All users of the following and possibly earlier versions of Panda security products for Windo...
GnuTLS and libtasn1 multiple security vulnerabilities
Buffer overflows, integer overflows, NULL pointer dereference...
HP IceWall DoS
No description provided...
VMWare privilege escalation
NULL pointer dereference in VMWare Tools for Windows...
NEW VMSA-2014-0005 - VMware Workstation, Player, Fusion, and ESXi patches address a guest privilege escalation
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2014-0005 Synopsis: VMware Workstation, Player, Fusion, and ESXi patches address a guest privilege escalation Issue date: 2014-05-29...
[security bulletin] HPSBGN03007 rev.1 - HP IceWall MCRP and HP IceWall SSO, Remote Denial of Service (DoS)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04278900 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04278900 Version: 1 HPSBGN03007 rev....
Panda products privilege escalation
No description provided...
[oss-security] GnuTLS and libtasn1 security fixes
Hi! New GnuTLS and libtasn1 versions fix few issues you might be interested to look at: http://www.gnutls.org/security.htmlGNUTLS-SA-2014-3 https://bugzilla.redhat.com/showbug.cgi?id=CVE-2014-3465 https://bugzilla.redhat.com/showbug.cgi?id=CVE-2014-3466...