[security bulletin] HPSBUX03369 SSRT102037 rev.1 - HP-UX execve(2), Local Elevation of Privilege

Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04735247 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04735247 Version: 1 HPSBUX03369 SSRT102037 rev.1 - HP-UX execve2, Local Elevation...

Logstash vulnerability CVE-2015-5619

Summary: Logstash 1.5.3 and prior versions are vulnerable to a SSL/TLS security issue which allows an attacker to successfully implement a man in the middle attack. This vulnerability is not present in the initial installation of Logstash. This insecurity is exposed when users configure Lumberjac...

APPLE-SA-2015-08-20-1 QuickTime 7.7.8

APPLE-SA-2015-08-20-1 QuickTime 7.7.8 QuickTime 7.7.8 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Processing a maliciously crafted file may lead to an unexpected application termination or arbitrary code execution Description: Multipl...

APPLE-SA-2015-08-13-4 OS X Server v4.1.5

APPLE-SA-2015-08-13-4 OS X Server v4.1.5 OS X Server v4.1.5 is now available and addresses the following: BIND Available for: OS X Yosemite v10.10.5 or later Impact: A remote attacker may be able to cause a denial of service Description: An assertion issue existed in the handling of TKEY packets...

Apple iOS multiple security vulnerabilities

Over 70 of different vulnerabilities...

Cisco Unified Communications Manager multiple security vulnerabilities

Code execution, authentication bypass, local files inclusion...

Apple Safari / Webkit multiple security vulnerabilities

Interface spoofing, memory corruption, restrictions bypass...

APPLE-SA-2015-08-13-3 iOS 8.4.1

APPLE-SA-2015-08-13-3 iOS 8.4.1 iOS 8.4.1 is now available and addresses the following: AppleFileConduit Available for: iPhone 4s and later, iPod touch 5th generation and later, iPad 2 and later Impact: A maliciously crafted afc command may allow access to protected parts of the filesystem...

Apple Mac OS X / OS X Server multiple security vulnerabilities

Over 150 different vulnerabilities in system components and libraries...

APPLE-SA-2015-08-13-1 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-08-13-1 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 is now available and addresses the following: Safari Application Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and O...

Cisco Unified Communications Manager Multiple Vulnerabilities (VP2015-001)

Vantage Point Security Advisory 2015-001 ======================================== Title: Cisco Unified Communications Manager Multiple Vulnerabilities Vendor: Cisco Vendor URL: http://www.cisco.com/ Versions affected: 9.2, 10.5.2, 11.0.1. Severity: Low to medium Vendor notified: Yes Reported: Oct...

APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006

APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006 OS X Yosemite v10.10.5 and Security Update 2015-006 is now available and addresses the following: apache Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.4 Impact: Multiple vulnerabilities existed in...

System Center Operations Manager crossite scripting

Crossite scripting in web interface...

Microsoft Office multiple security vulnerabilities

Memory corruptions, code execution...

squid restrictions bypass

Restrictions bypass is possible under some configurations...

FreeBSD Security Advisory FreeBSD-SA-15:19.routed

============================================================================= FreeBSD-SA-15:19.routed Security Advisory The FreeBSD Project Topic: routed8 remote denial of service vulnerability Category: core Module: routed Announced: 2015-08-05 Credits: Hiroki Sato Affects: All supported version...

FreeBSD routed DoS

Crash on RIP request from non-directly connected network...

FreeBSD Security Advisory FreeBSD-SA-15:18.bsdpatch

============================================================================= FreeBSD-SA-15:18.bsdpatch Security Advisory The FreeBSD Project Topic: shell injection vulnerability in patch1 Category: contrib Module: patch Announced: 2015-08-05 Credits: Martin Natano Affects: FreeBSD 10.x. Correcte...

FreeBSD patch code execution

Commands injection is possible...

[SECURITY] [DSA 3327-1] squid3 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3327-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 03, 2015 https://www.debian.org/security/faq -...

[USN-2692-1] QEMU vulnerabilities

========================================================================== Ubuntu Security Notice USN-2692-1 July 28, 2015 qemu vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...

ISC bind named DoS

Assert on TKEY request processing...

HPLIP restrictions bypas

Invalid GPG key retrieval from server...

Cisco ASR routers DoS

Crash on fragmented packets processing...

FreeBSD Security Advisory FreeBSD-SA-15:14.bsdpatch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-15:14.bsdpatch Security Advisory The FreeBSD Project Topic: shell injection vulnerability in patch1 Category: contrib Module: patch Announced: 2015-07-28 Credit...

[SECURITY] [DSA 3318-1] expat security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3318-1 [email protected] https://www.debian.org/security/ Laszlo Boszormenyi GCS July 26, 2015 https://www.debian.org/security/faq -...

expat library integer overflow

Multiple integer overflows...

[USN-2697-1] Ghostscript vulnerability

========================================================================== Ubuntu Security Notice USN-2697-1 July 30, 2015 ghostscript vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

FreeBSD Security Advisory FreeBSD-SA-15:17.bind

============================================================================= FreeBSD-SA-15:17.bind Security Advisory The FreeBSD Project Topic: BIND remote denial of service vulnerability Category: contrib Module: bind Announced: 2015-07-28 Credits: ISC Affects: FreeBSD 8.x and FreeBSD 9.x...

[USN-2699-1] HPLIP vulnerability

========================================================================== Ubuntu Security Notice USN-2699-1 July 30, 2015 hplip vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu...

ghostscript memory corruption

Memory corruption on Postscript file parsing...

[SECURITY] [DSA 3320-1] openafs security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3320-1 [email protected] https://www.debian.org/security/ Sebastien Delafond July 30, 2015 https://www.debian.org/security/faq -...

OpenAFS multiple security vulnerabilities

Information disclosure, DoS...

[SECURITY] [DSA 3321-1] xmltooling security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3321-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini July 30, 2015 https://www.debian.org/security/faq -...

[USN-2694-1] PCRE vulnerabilities

========================================================================== Ubuntu Security Notice USN-2694-1 July 29, 2015 pcre3 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...

DoS против библиотеки XMLTooling

Unhandled exception on processing XML with invalid schema...

PCRE multiple security vulnerabilities

Multiple memory corruptions on PCRE parsing...

FreeBSD Security Advisory FreeBSD-SA-15:16.openssh [REVISED]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-15:16.openssh Security Advisory The FreeBSD Project Topic: OpenSSH multiple vulnerabilities Category: contrib Module: openssh Announced: 2015-07-28, revised on...

Logstash vulnerability CVE-2015-5378

Summary: Logstash 1.5.2 and prior versions are vulnerable to a SSL/TLS security issue called the FREAK attack. If you are using the Lumberjack input, FREAK allows an attacker to successfully implement a man in the middle attack, intercepting communication between the Logstash Forwarder agent and...

SEC Consult SA-20150716-0 :: Permanent Cross-Site Scripting in Oracle Application Express

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20150716-0 ======================================================================= title: Permanent Cross-Site Scripting product: Oracle Application Express vulnerable version: All versions prior to...

[SECURITY] [DSA 3314-1] typo3-src end of life

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3314-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 23, 2015 https://www.debian.org/security/faq -...

[USN-2675-1] LXC vulnerabilities

========================================================================== Ubuntu Security Notice USN-2675-1 July 22, 2015 lxc vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu...

Hawkeye-G v3.0.1.4912 CSRF Vulnerability CVE-2015-2878

UPDATED CORRECTION + Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-HAWKEYEG0724.txt Vulnerability Type: =================== CSRF CVE Reference: ============== CVE-2015-2878 Vendor: =================== www.hexiscyber.com...

CVE-2015-5379: Axigen XSS vulnerability for html attachments

CVEID: CVE-2015-5379 SUBJECT: Axigen XSS vulnerability for html attachments DESCRIPTION: Axigen's WebMail Ajax interface implements a view attachment function that executes javascript code that is part of email HTML attachments. This allows a malicious user to craft email messages that could expo...

Novell GroupWise 2014 WebAccess vulnerable to XSS attacks

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-021 Product: GroupWise Vendor: Novell Affected Versions: 2014 Tested Versions: 2014 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: High Solution Status: Fixed Vendor Notification: 2015-05-04 Solution Date:...

ThaiWeb CMS 2015Q3 - SQL Injection Web Vulnerability

Document Title: =============== ThaiWeb CMS 2015Q3 - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1555 Release Date: ============= 2015-07-23 Vulnerability Laboratory ID VL-ID: ==================================== 1555...

Cisco Videoscape Delivery System DoS

It's possible to reload device with HTTP request...

Multiple (remote and local) Vulnerabilities in Xceedium Xsuite [MZ-15-02]

See also: http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt --------------------------------------------------------------------- modzero Security Advisory: Multiple Vulnerabilities in Xceedium Xsuite MZ-15-02 ---------------------------------------------------------------------...

Elastic Logstash directory traversal

Directory traversal in file output plugin...

Multiple XSS Vulnerabilities in Paid Memberships Pro WordPress Plugin

Advisory ID: HTB23264 Product: Paid Memberships Pro WordPress plugin Vendor: Stranger Studios Vulnerable Versions: 1.8.4.2 and probably prior Tested Version: 1.8.4.2 Advisory Publication: July 1, 2015 without technical details Vendor Notification: July 1, 2015 Vendor Patch: July 8, 2015 Public...