exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 168 RSS Feed

Files

Debian Security Advisory 2717-1
Posted Jun 28, 2013
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2717-1 - Jon Erickson of iSIGHT Partners Labs discovered a heap overflow in xml-security-c, an implementation of the XML Digital Security specification. The fix to address CVE-2013-2154 introduced the possibility of a heap overflow in the processing of malformed XPointer expressions in the XML Signature Reference processing code, possibly leading to arbitrary code execution.

tags | advisory, overflow, arbitrary, code execution
systems | linux, debian
advisories | CVE-2013-2210
SHA-256 | 725b2cb7a37e030f1ad6211488f3d9519ceec802f0dec6c149a6cb4feddff9d9
Mandriva Linux Security Advisory 2013-186
Posted Jun 28, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-186 - Updated puppet packages fix remote code execution vulnerability. When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload.

tags | advisory, remote, code execution, ruby
systems | linux, mandriva
advisories | CVE-2013-3567
SHA-256 | 16f6e339b6a971acf0f5568057324baccf34ac55672e355b9b72c2f8fcd7cc2c
Slackware Security Advisory - ruby Updates
Posted Jun 28, 2013
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New ruby packages are available for Slackware 13.1, 13.37, 14.0, and -current to fix a security issue. Related CVE Numbers: CVE-2013-4073.

tags | advisory, ruby
systems | linux, slackware
advisories | CVE-2013-4073
SHA-256 | 33d0d087342bdf2fa53a28d6a242ae11609f420907abb65ded11817048c7bb01
Red Hat Security Advisory 2013-1001-01
Posted Jun 28, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-1001-01 - In accordance with the Red Hat Enterprise Linux Errata Support Policy, Extended Update Support for Red Hat Enterprise Linux 6.2 will be retired on December 31, 2013, and support will no longer be provided. Accordingly, Red Hat will no longer provide updated packages, including critical impact security patches or urgent priority bug fixes, for Red Hat Enterprise Linux 6.2 EUS after that date. In addition, after December 31, 2013, technical support through Red Hat's Global Support Services will no longer be provided. Note: This notification applies only to those customers subscribed to the Extended Update Support channel for Red Hat Enterprise Linux 6.2.

tags | advisory
systems | linux, redhat
SHA-256 | 6651532a366053d7aeef4d6c4d47b1f8d4b2f87de49d4e9f9f09264a620db639
Sony Playstation Network Password Reset
Posted Jun 28, 2013
Authored by Benjamin Kunz Mejri, Vulnerability Laboratory | Site vulnerability-lab.com

A critical password reset (session) vulnerability was detected in the Sony PSN Network web server auth system account application. The vulnerability allows remote attackers without a privileged application account to exchange session values and reset any psn user accounts.

tags | advisory, remote, web
SHA-256 | 7d2f60f06b1f589958b985c9d294460f3f3b1163bb51e8e1a6e79d4d54e5a3ba
Apache Santuario XML Security For C++ Heap Overflow
Posted Jun 27, 2013
Authored by Jon Erickson

The attempted fix to address CVE-2013-2154 introduced the possibility of a heap overflow, possibly leading to arbitrary code execution, in the processing of malformed XPointer expressions in the XML Signature Reference processing code. An attacker could use this to exploit an application performing signature verification if the application does not block the evaluation of such references prior to performing the verification step. The exploit would occur prior to the actual verification of the signature, so does not require authenticated content. Apache Santuario XML Security for C++ library versions prior to 1.7.2 are affected.

tags | advisory, overflow, arbitrary, code execution
advisories | CVE-2013-2154, CVE-2013-2210
SHA-256 | ed557eaf432b8220b8a580b3a0a313162a1d2211f6e1ea637a19dc2d29e16038
HP Security Bulletin HPSBUX02886
Posted Jun 27, 2013
Authored by HP | Site hp.com

HP Security Bulletin HPSBUX02886 - A potential security vulnerability has been identified with HP-UX running HP Secure Shell. The vulnerability could be exploited remotely to create a Denial of Service (DoS). Revision 1 of this advisory.

tags | advisory, denial of service, shell
systems | hpux
advisories | CVE-2010-5107
SHA-256 | cac1fdeec8a55f1c45ad6c9cca7c998c11e3e1e01ed4039be8e9ca602e7613b0
HP Security Bulletin HPSBST02890
Posted Jun 27, 2013
Authored by HP | Site hp.com

HP Security Bulletin HPSBST02890 - A potential security vulnerability has been identified with HP StoreOnce D2D Backup System. The vulnerability could be exploited remotely resulting in unauthorized access and modification. Please note that this issue does not affect HP StoreOnce Backup systems that are running software version 3.0.0 or newer. Devices running software version 3.0.0 or newer do not have a HPSupport user account with a pre-set password configured. A user who is logged in via the HPSupport user account does not have access to the data that has been backed up to the HP StoreOnce Backup system, and hence is not able to read or download the backed up data. However, it is possible to reset the device to factory defaults, and hence delete all backed up data that is present on the device. Revision 1 of this advisory.

tags | advisory
advisories | CVE-2013-2342
SHA-256 | 836f157ebc6e5df575b140451776908b9f5ec88b67f885a256788ec84f8a2a59
Red Hat Security Advisory 2013-0992-01
Posted Jun 27, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0992-01 - Python-keystoneclient is the client library and command line utility for interacting with the OpenStack identity API. A flaw was found in the way python-keystoneclient handled encrypted data from memcached. Even when the memcache_security_strategy setting in "/etc/swift/proxy-server.conf" was set to ENCRYPT to help prevent tampering, an attacker on the local network, or possibly an unprivileged user in a virtual machine hosted on OpenStack, could use this flaw to bypass intended restrictions and modify data in memcached that will later be used by services utilizing python-keystoneclient.

tags | advisory, local, python
systems | linux, redhat
advisories | CVE-2013-2166, CVE-2013-2167
SHA-256 | 0b46ee70e661aac86fcfce7d4bfb6636c8819246323ca5bac1086eda68288cae
Red Hat Security Advisory 2013-0997-01
Posted Jun 27, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0997-01 - This is the 5-Month notification of the End Of Life plans for Red Hat Storage Software Appliance 3.2 and Red Hat Virtual Storage Software Appliance 3.2. In accordance with the Red Hat Storage Software Appliance Support Life Cycle Policy, support will end on November 30, 2013. Red Hat will not provide extended support for this product. Customers are requested to migrate to the newer Red Hat Storage Server product once the life cycle for SSA and VSA is complete. If customers cannot migrate, the product will become unsupported. In addition, after November 30, 2013, technical support through Red Hat’s Global Support Services will no longer be provided. We encourage customers to plan their migration from Storage Software Appliance 3.2 to the latest version of Red Hat Storage Server. Please contact your Red Hat account representative if you have questions and/or concerns on this matter.

tags | advisory
systems | linux, redhat
SHA-256 | f027ef4acb05402b88530668fa3538e2e6c30aefee4fda63be63ff6f1ef48acc
Red Hat Security Advisory 2013-0993-01
Posted Jun 27, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0993-01 - OpenStack Swift is a highly available, distributed, eventually consistent object/blob store. An XML injection flaw in OpenStack Swift could allow remote attackers to manipulate the contents of XML responses via specially-crafted data. This could be used to trigger a denial of service.

tags | advisory, remote, denial of service, xxe
systems | linux, redhat
advisories | CVE-2013-2161
SHA-256 | 28a8b98698ba460b04f7bcbc2c2b29b15adacb9c2f421378f5d59be53638b7c8
Red Hat Security Advisory 2013-0996-01
Posted Jun 27, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0996-01 - In accordance with the Red Hat Enterprise Linux Errata Support Policy, Extended Update Support for Red Hat Enterprise Linux 5.6 will be retired on July 31, 2013, and support will no longer be provided. Accordingly, Red Hat will no longer provide updated packages, including critical impact security patches or urgent priority bug fixes, for Red Hat Enterprise Linux 5.6 EUS after that date. In addition, after July 31, 2013, technical support through Red Hat's Global Support Services will no longer be provided. Note: This notification applies only to those customers subscribed to the Extended Update Support channel for Red Hat Enterprise Linux 5.6.

tags | advisory
systems | linux, redhat
SHA-256 | 8b83fe4c652ad4ec0b42ead3c74029eeef6a895684a862769aa70d58e2be94e5
Red Hat Security Advisory 2013-0994-01
Posted Jun 27, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0994-01 - The openstack-keystone packages provide Keystone, a Python implementation of the OpenStack identity service API, which provides Identity, Token, Catalog, and Policy services. A flaw was found in the way Keystone handled LDAP based authentication. If Keystone was configured to use LDAP authentication, and the LDAP server was configured to allow anonymous binds, anyone able to connect to a given service using Keystone could connect as any user, including the admin, without supplying a password.

tags | advisory, python
systems | linux, redhat
advisories | CVE-2013-2157
SHA-256 | 32c7604db4e8db147fcbddd83a091aa60f03d25791155e16d28b79f42a471506
Red Hat Security Advisory 2013-0995-01
Posted Jun 27, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0995-01 - A flaw was found in the create method of the Foreman Bookmarks controller. A user with privileges to create a bookmark could use this flaw to execute arbitrary code with the privileges of the user running Foreman, giving them control of the system running Foreman and all systems managed by Foreman.

tags | advisory, arbitrary
systems | linux, redhat
advisories | CVE-2013-2113, CVE-2013-2121
SHA-256 | a6ea90b4ec301210ea27cf545a21cf478f09de9e3ff6fc69ffd8f53ff3497b99
Debian Security Advisory 2715-1
Posted Jun 27, 2013
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2715-1 - It was discovered that puppet, a centralized configuration management system, did not correctly handle YAML payloads. A remote attacker could use a specially-crafted payload to execute arbitrary code on the puppet master.

tags | advisory, remote, arbitrary
systems | linux, debian
advisories | CVE-2013-3567
SHA-256 | fd2dc8e5853dbe33e218f6b50151a763e0ba4dd4cf9901134c0e021f9d1edac1
Ubuntu Security Notice USN-1893-1
Posted Jun 27, 2013
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1893-1 - Alexander Klink discovered that the Subversion mod_dav_svn module for Apache did not properly handle a large number of properties. A remote authenticated attacker could use this flaw to cause memory consumption, leading to a denial of service. Ben Reser discovered that the Subversion mod_dav_svn module for Apache did not properly handle certain LOCKs. A remote authenticated attacker could use this flaw to cause Subversion to crash, leading to a denial of service. Various other issues were also addressed.

tags | advisory, remote, denial of service
systems | linux, ubuntu
advisories | CVE-2013-1845, CVE-2013-1846, CVE-2013-1847, CVE-2013-1849, CVE-2013-1884, CVE-2013-1968, CVE-2013-2112, CVE-2013-1845, CVE-2013-1846, CVE-2013-1847, CVE-2013-1849, CVE-2013-1884, CVE-2013-1968, CVE-2013-2112
SHA-256 | fadad9d01a7a48363d8538dad2db68b65dffa4ac54afcd7eeb83be412b82d57b
Ubuntu Security Notice USN-1892-1
Posted Jun 27, 2013
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1892-1 - It was discovered that ubuntu-release-upgrader would fail when a user requested an upgrade to Ubuntu 13.04. This would prevent a user from migrating easily to Ubuntu 13.04 before the Ubuntu 12.10 support period ended.

tags | advisory
systems | linux, ubuntu
SHA-256 | c45c0cfedb56dfcb1b096118732bb29d017bc74a99184bfb68ea3a9190520815
Mandriva Linux Security Advisory 2013-185
Posted Jun 27, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-185 - Updated perl-Module-Signature package fixes CVE-2013-2145. Arbitrary code execution vulnerability in Module::Signature before 0.72.

tags | advisory, arbitrary, perl, code execution
systems | linux, mandriva
advisories | CVE-2013-2145
SHA-256 | c7e5d5ed176a33a19145b6155e1725b3cb982169c35e3e86fd5f5833bf0d01e6
Mandriva Linux Security Advisory 2013-184
Posted Jun 27, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-184 - Updated perl-Dancer package fixes CVE-2012-5572. A security flaw was found in the way Dancer.pm, lightweight yet powerful web application framework / Perl language module, performed sanitization of values to be used for cookie() and cookies() methods. A remote attacker could use this flaw to inject arbitrary headers into responses from applications, that use Dancer.pm.

tags | advisory, remote, web, arbitrary, perl
systems | linux, mandriva
advisories | CVE-2012-5572
SHA-256 | 5e4cd0dafb01b5590970bbb3187e0e97b40f6c3f624e3f8d33655f466899e46f
Mandriva Linux Security Advisory 2013-183
Posted Jun 27, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-183 - Updated java-1.7.0-openjdk packages fix multiple security vulnerabilities. Multiple flaws were discovered in the ImagingLib and the image attribute, channel, layout and raster processing in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption. Integer overflow flaws were found in the way AWT processed certain input. An attacker could use these flaws to execute arbitrary code with the privileges of the user running an untrusted Java applet or application. Various other issues were addressed.

tags | advisory, java, overflow, arbitrary, vulnerability
systems | linux, mandriva
advisories | CVE-2013-1500, CVE-2013-1571, CVE-2013-2407, CVE-2013-2412, CVE-2013-2443, CVE-2013-2444, CVE-2013-2445, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2449, CVE-2013-2450, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2458, CVE-2013-2459, CVE-2013-2460, CVE-2013-2461, CVE-2013-2463, CVE-2013-2465, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472
SHA-256 | 3bc21ccc47d661daa96394b723e72056e5e5367a29aeae7693f91c800dd74b49
Mandriva Linux Security Advisory 2013-182
Posted Jun 27, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-182 - Updated mesa packages fix multiple vulnerabilities. An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs (Mozilla Firefox does this), an attacker could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. It was found that Mesa did not correctly validate messages from the X server. A malicious X server could cause an application using Mesa to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

tags | advisory, arbitrary, vulnerability
systems | linux, mandriva
advisories | CVE-2013-1872, CVE-2013-1993
SHA-256 | a90b8aaa0be2c76505077698e6b25ae7036e5269415ca1a9259e114ff2f855f1
Mandriva Linux Security Advisory 2013-181
Posted Jun 27, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-181 - Multiple integer overflows in X.org libGLX in Mesa 9.1.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XF86DRIOpenConnection and XF86DRIGetClientDriverName functions. The updated packages have been patched to correct this issue.

tags | advisory, overflow
systems | linux, mandriva
advisories | CVE-2013-1993
SHA-256 | a4beeeb10e775810693019d4dc5ba38575cb1e9c3f90070c99872a9c19730354
Mandriva Linux Security Advisory 2013-180
Posted Jun 27, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-180 - libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption. The function curl_easy_unescape() decodes URL encoded strings to raw binary data. URL encoded octets are represented with \%HH combinations where HH is a two-digit hexadecimal number. The decoded string is written to an allocated memory area that the function returns to the caller. The updated packages have been patched to correct this issue.

tags | advisory
systems | linux, mandriva
advisories | CVE-2013-2174
SHA-256 | 8930cdf17b729214cd1f709f26c69dc0640e1825f1cf4dcfb9fa79a62710a602
Cisco Security Advisory 20130626-ngfw
Posted Jun 27, 2013
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - Cisco ASA Next-Generation Firewall (NGFW) Services contains a Fragmented Traffic Denial of Service (DoS) vulnerability. Successful exploitation of this vulnerability on the Cisco ASA NGFW could cause the device to reload or stop processing user traffic that has been redirected by the parent Cisco ASA to the ASA NGFW module for further inspection. There are no workarounds for this vulnerability, but mitigations are available. Cisco has released free software updates that address this vulnerability.

tags | advisory, denial of service
systems | cisco
SHA-256 | ec64974b2ac07ab492e1a5dfadb995c59febd0ac9849aedd50b4abf8aa81eb7b
Cisco Security Advisory 20130626-sma
Posted Jun 27, 2013
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - Cisco IronPort AsyncOS Software for Cisco Content Security Management Appliance is affected by command injection and denial of service vulnerabilities. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available.

tags | advisory, denial of service, vulnerability
systems | cisco
SHA-256 | 3fc7baaa77ed48d81b4f09eba8467c1626fa1a90dd426aa437bd73366e18973a
Page 1 of 7
Back12345Next

Top Authors In Last 30 Days

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close