Ubuntu Security Notice 2030-1 - Multiple security issues were discovered in NSS. If a user were tricked into connecting to a malicious server, an attacker could possibly exploit these to cause a denial of service via application crash, potentially execute arbitrary code, or lead to information disclosure. This update also adds TLS v1.2 support to Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 12.10, and Ubuntu 13.04.
88d0a7e54ad7c4580130985a1ea62ac214b9e93f97f5151289a1646fd2f8e8ebDebian Linux Security Advisory 2798-1 - Scott Cantor discovered that curl, a file retrieval tool, would disable the CURLOPT_SSLVERIFYHOST check when the CURLOPT_SSL_VERIFYPEER setting was disabled. This would also disable ssl certificate host name checks when it should have only disabled verification of the certificate trust chain.
9363b2d66b1be8b2c64a2ee99bfb751ea42ee87086b3cd18e8fcae0ba052400fRed Hat Security Advisory 2013-1526-01 - Nagios is a program that can monitor hosts and services on your network. It can send email or page alerts when problems arise and when problems are resolved. Multiple insecure temporary file creation flaws were found in Nagios. A local attacker could use these flaws to cause arbitrary files to be overwritten as the root user via a symbolic link attack. These issues were discovered by Grant Murphy of the Red Hat Product Security Team.
26ed51d06c4f102c04988c4bda77685e8771e157d676f92bd65c4733b3fcd5f6Red Hat Security Advisory 2013-1525-01 - The openstack-glance packages provide a service that acts as a registry for virtual machine images. A flaw was found in the Glance download_image policy enforcement for cached system images. When an image was previously cached by an authorized download, any authenticated user able to determine the image by its UUID could download that image, bypassing the download_image policy. Only setups making use of the download_image policy were affected.
e0eb3f673d25b971dfa5e7bcb73d6d651ce3b1ffe95cdbb2b5cf1de8b7715300Red Hat Security Advisory 2013-1524-01 - The openstack-keystone packages provide Keystone, a Python implementation of the OpenStack identity service API, which provides Identity, Token, Catalog, and Policy services. It was found that tokens issued to a tenant were not invalidated when that tenant was disabled in Keystone. This could allow users assigned to a disabled tenant to retain access to resources they should no longer be able to access. These updated packages have been upgraded to upstream version 2013.1.4, which provides a number of bug fixes over the previous version.
b24f71928e7f9e525e30eb87c9d89f612ec145a89de4dc93edae2fdb4ed1e42bThe bt8xx video driver in the Linux kernel suffers from an integer overflow that can trigger a kernel panic. Kernel versions 2.6.18 and below are affected.
5e999ef89be83bedfff1b0aeeec2f2106773a720437d97c4c3579bce3dba124eDebian Linux Security Advisory 2795-2 - It was discovered discovered that SSL connections with client certificates stopped working after the DSA-2795-1 update of lighttpd. An upstream patch has now been applied that provides an appropriate identifier for client certificate verification.
6ea08a640d945842f0d2904e7fd354564b3f05ed8e6a0b71145488693257820bThe qlxge/qlxgbe driver in FreeBSD versions 10 and below has vulnerabilities that leak arbitrary kernel memory to the userspace.
7b42f8e5e80bb47fb47ae99870c929935ee839ea7eb108eb27deef74da4fab32The nand driver in FreeBSD versions 10 and below has a vulnerability that leaks arbitrary kernel memory to the userspace.
11705da0b8bfd9c3bd8fe8bfbd867f3c93cda8e18da5a35626eb3d8ff3c47e6cIt has been identified that OpenVAS Manager and OpenVAS Administrator are vulnerable to authentication bypass due to an incorrect state assignment when processing OMP and OAP requests. It has been identified that this vulnerability may allow unauthorised access to OpenVAS Manager and OpenVAS Administrator on vulnerable systems.
fea21aeb4dde6897080ead6cceae08c814ff068c37348f8083727463c74d3633ZX Java Framework versions prior to 5.0.13 suffer from a cross site scripting vulnerability.
58b97ae36bcb3d780262abc22016fa03c15a74f595d100c33055ba6e8478798bApple Security Advisory 2013-11-14-1 - iOS 7.0.4 is now available and addresses an issue where a signed-in user may be able to complete a transaction without providing a password when prompted. This issue was addressed by additional enforcement of purchase authorization.
a41101da829326f25d224a743d9cf1b1c941aada63bc008af23542d5df1616a3VMware Security Advisory 2013-0013 - VMware has updated VMware Workstation and VMware Player to address a vulnerability that could result in an escalation of privilege on Linux-based host machines.
3bc47daa98136732b874042b14387b0cf0891a83da155e6373c023b5444f3117Red Hat Security Advisory 2013-1523-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. RubyGems is the Ruby standard for publishing and managing third-party libraries. It was discovered that the rubygems API validated version strings using an unsafe regular expression. An application making use of this API to process a version string from an untrusted source could be vulnerable to a denial of service attack through CPU exhaustion.
87f29239c7e2f52b6486a676d86548aacadbd440f6c8196abcfa2d987d9e6ad9Red Hat Security Advisory 2013-1522-01 - The Foreman packages provide facilities for rapidly deploying Red Hat OpenStack 3.0. These packages are provided as a Technology Preview. For more information on the scope and nature of support for items marked as Technology Preview, refer to https://access.redhat.com/support/offerings/techpreview/ It was found that Foreman did not correctly sanitize values of the "fqdn" and "hostgroup" parameters, allowing an attacker to provide a specially crafted value for these parameters and perform an SQL injection attack.
882fbca6772b0916e0958e824ed243b5219a9837225a71e9a0e65782c286fb07Checkpoint Endpoint Security Media Encryption Explorer version 4.97.2 (Endpoint Security R73) contains two issues which can help to bypass the failed password attempts limit established in the password policy.
d45ede8228777b255c99202f1374063461f34fa72e724348fe261b37ed4a87e9Red Hat Security Advisory 2013-1521-01 - Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle. It was discovered that the django.utils.http.is_safe_url() function considered any URL that used a scheme other than HTTP or HTTPS as safe. An attacker could potentially use this flaw to perform cross-site scripting attacks. A directory traversal flaw was found in Django's "ssi" template tag, which takes a file path as input and outputs that file's contents. An attacker able to alter templates that made use of the "ssi" tag on a site could use this flaw to access any local files accessible to Django.
7944b271df0a414473dfe8d8e114b4c4bbe4b1fc6747d98e0d3bd3fc081b215bRed Hat Security Advisory 2013-1520-01 - Red Hat OpenStack 3.0 includes a custom Red Hat Enterprise Linux 6.4 kernel. These custom kernel packages include support for network namespaces; this support is required to facilitate advanced OpenStack Networking deployments. A flaw was found in the way the Linux kernel's TCP/IP protocol suite implementation handled IPv6 sockets that used the UDP_CORK option. A local, unprivileged user could use this flaw to cause a denial of service. An information leak flaw was found in the way the Linux kernel's device mapper subsystem, under certain conditions, interpreted data written to snapshot block devices. An attacker could use this flaw to read data from disk blocks in free space, which are normally inaccessible.
7008a13256f2ff111c9742864c6951d05dc88eb72924ebacdbb0c1381a4ed58aDebian Linux Security Advisory 2797-1 - Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client. Multiple memory safety errors, and other implementation errors may lead to the execution of arbitrary code.
029e07b0bb2ef86a6578517759da390da13badd9b547fa9b121c3f711992923cDebian Linux Security Advisory 2796-1 - Matt Ezell from Oak Ridge National Labs reported a vulnerability in torque, a PBS-derived batch processing queueing system.
8c1ab3f9d4ec34b474a39b54a38613b2324aa25e984e9b49b4c99b5a3a39637fGentoo Linux Security Advisory 201311-9 - Multiple vulnerabilities have been found in FreeRADIUS, the worst of which allow execution of arbitrary code or Denial of Service. Versions less than 2.2.0 are affected.
57bcce463337b741d7d21b72cef8fb2112833dc0e82e9e2ffac188cc8c2cd7edRed Hat Security Advisory 2013-1519-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. A race condition was found in the way asynchronous I/O and fallocate() interacted when using the ext4 file system. A local, unprivileged user could use this flaw to expose random data from an extent whose data blocks have not yet been written, and thus contain data from a deleted file. An information leak flaw was found in the way Linux kernel's device mapper subsystem, under certain conditions, interpreted data written to snapshot block devices. An attacker could use this flaw to read data from disk blocks in free space, which are normally inaccessible.
b7e3670d1883b8a69860346779ea0650b4c74cff69296f9794b964c54532bad5Gentoo Linux Security Advisory 201311-8 - A vulnerability in Netpbm could result in execution of arbitrary code or Denial of Service. Versions less than 10.49.00 are affected.
ea8452d7a1cee55fb0d6a0685cf72c7fe00baa2d82e6e1e8656247eb497acac8Red Hat Security Advisory 2013-1518-01 - The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security bulletin APSB13-26, listed in the References section. Specially-crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the malicious SWF content. All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.327.
178b171f3369f1af2726ea0d63663fd56d037b6043e9271330d369a6b06ba904Ubuntu Security Notice 2029-1 - It was discovered that Apache Commons FileUpload incorrectly handled file names with NULL bytes in serialized instances. An attacker could use this issue to possibly write to arbitrary files.
e46f28c46612b15cb45c3973ca0a42be6548193b0092ba892008a75ab4d2f9b3
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed