Vulnerable Microsoft VC++ 2005 RTM runtime libraries installed with "Microsoft Security Essentials" (and numerous other Microsoft products)

Hi @ll, this is part 2 of "Defense in depth -- the Microsoft way", see http://seclists.org/fulldisclosure/2013/May/107 On Windows NT 5.x the current "Microsoft Security Essentials" v4.2 available from http://www.microsoft.com/securityessentials, and offered as optional update KB2804527 via...

MIT Kerberos 5 DoS

Server sends response to response, it makes it possible to loop packets between two servers...

Sketchup multiple security vulnerabilities

Vulnerabilities on SKP, BMP, PICT parsing...

DS3 Authentication Server - Multiple Issues

Original: http://www.digitalsec.net/stuff/explt+advs/DS3.AuthServer.txt =============================== - Advisory - =============================== Tittle: DS3 Authentication Server - Command Execution Post Authentication & other minor issues Risk: High Date: 27.May.2013 Author: Pedro Andujar .:...

Unauthenticated command execution on Netgear DGN devices

Unauthenticated command execution on Netgear DGN devices ======================================================== ADVISORY INFORMATION Title: Unauthenticated command execution on Netgear DGN devices Discovery date: 01/05/2013 Release date: 31/05/2013 Credits: Roberto Paleari [email protected],...

gnutls DoS

Out-of-bounds read on packet decoding...

Imperva SecureSphere Operations Manager multiple security vulnerabilities

Multiple web interface vulnerabilities...

DS3 Authentication Server multiple security vulnerabilities

Multiple web interface security vulnerabilities...

[SECURITY] [DSA 2693-1] libx11 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2693-1 [email protected] http://www.debian.org/security/ Raphael Geissert May 24, 2013 http://www.debian.org/security/faq -...

CVE-2013-3662 - Sketchup MAC Pict Material Palette Stack Corruption

If you are still using an old version of SketchUp8M2 you should upgrade it. Title: Sketchup MAC Pict Material Palette Stack Corruption Product: Google SketchUp Advisory ID: BINA-20111201 CVE ID: CVE-2013-3662 Class: Boundary Error Condition Buffer Overflow Vulnerability class: Client side/ file...

CVE-2013-3663 - SketchUp BMP RLE8 Heap Overflow

If you are still using a not so old version of SketchUp8M3 you should upgrade it... Title: SketchUp BMP RLE8 Heap Overflow Product: Google SketchUp Advisory ID: BINA-20120523 CVE ID: CVE-2013-3663 Class: Boundary Error Condition Buffer Overflow Vulnerability class: Client side/ file format...

[SECURITY] [DSA 2701-1] krb5 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2701-1 [email protected] http://www.debian.org/security/ Michael Gilbert May 29, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2688-1] libxres security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2688-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

APPLE-SA-2013-05-22-1 QuickTime 7.7.4

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-05-22-1 QuickTime 7.7.4 QuickTime 7.7.4 is now available and addresses the following: QuickTime Available for: Windows 7, Vista, XP SP2 or later Impact: Opening a maliciously crafted TeXML file may lead to an unexpected application...

[SECURITY] [DSA 2678-1] mesa security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2678-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

Apple iTunes multiple security vulnerabilities

Certificate validation vulnerability, multiple memory corruptions...

[SECURITY] [DSA 2673-1] libdmx security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2673-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

Microsoft Internet Explorer multiple security vulnerabilities

Information leakage, multiple use-after-free vulnerabilities...

[SECURITY] [DSA 2689-1] libxtst security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2689-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

[security bulletin] HPSBUX02881 SSRT101189 rev.1 - HP-UX Directory Server, Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03772083 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03772083 Version: 1 HPSBUX02881...

Microsoft Lync code execution

Use-after-free vulnerability...

[SECURITY] [DSA 2683-1] libxi security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2683-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2692-1] libxxf86vm security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2692-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

Microsoft Windows multiple security vulnerabilities

http.sys DoS, multiple kernel privilege escalations, .Net signature spoofing and authorization bypass...

[SECURITY] [DSA 2675-1] libxvmc security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2675-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

VUPEN Security Research - Microsoft Internet Explorer 10-9 Object Confusion Sandbox Bypass (MS13-037 / Pwn2Own)

VUPEN Security Research - Microsoft Internet Explorer 10-9 Object Confusion Sandbox Bypass MS13-037 / Pwn2Own Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Microsoft Internet Explorer is a web browser developed by Microsoft and included as...

[SECURITY] [DSA 2680-1] libxt security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2680-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2684-1] libxrandr security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2684-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2691-1] libxinerama security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2691-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

HP-UX Directory Server informaton leakage

No description provided...

[SECURITY] [DSA 2677-1] libxrender security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2677-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2681-1] libxcursor security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2681-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

APPLE-SA-2013-05-16-1 iTunes 11.0.3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-05-16-1 iTunes 11.0.3 iTunes 11.0.3 is now available and addresses the following: iTunes Available for: Mac OS X v10.6.8 or later, Windows 7, Vista, XP SP2 or later Impact: An attacker in a privileged network position may manipulate HTTP...

VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 VML Remote Integer Overflow (MS13-037 / Pwn2Own)

VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 VML Remote Integer Overflow MS13-037 / Pwn2Own Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Microsoft Internet Explorer is a web browser developed by Microsoft and included a...

Microsoft Visio information leakage

Information leakage via external XML entities...

Microsoft Office multiple security vulnerabilities

Multiple buffer overflows, integer overflows, memory corruptions, etc...

[SECURITY] [DSA 2674-1] libxv security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2674-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2687-1] libfs security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2687-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

Microsoft Windows Essentials information leakage

Microsoft Writer invalid URL handling...

[SECURITY] [DSA 2675-2] libxvmc regression update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2675-2 [email protected] http://www.debian.org/security/ Thijs Kinkhorst May 24, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2682-1] libxext security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2682-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2685-1] libxp security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2685-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2676-1] libxfixes security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2676-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2679-1] xserver-xorg-video-openchrome security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2679-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2690-1] libxxf86dga security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2690-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

[USN-1833-1] Linux kernel vulnerabilities

========================================================================== Ubuntu Security Notice USN-1833-1 May 24, 2013 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...

Linux kernel multiple security vulnerabilities

Privilege escalation via suid-process output redirection, unix sockets privilege escalation, UDF and ISO filesystem drivers information leakage, i915 driver memory corruption, multiple KVM vulnerabilities, ext3 driver privilege escalation, netlink information leakages...

[SECURITY] [DSA 2686-1] libxcb security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2686-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 23, 2013 http://www.debian.org/security/faq -...

Apple QuickTime multiple security vulnerabilities

Memory corruptions on different formats and protocols parsing...

Vulnerability in "Fujitsu Desktop Update" (for Windows)

Hi @ll, Fujitsu's update utility "Fujitsu Desktop Update" see http://support.ts.fujitsu.com/DeskUpdate/Index.asp, which is factory-preinstalled on every Fujitsu Siemens PC with Windows, has a vulnerability which allows the execution of a rogue program in the security context of the current user...