Red Hat Security Advisory 2015-1135-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code. A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time.
cd29d265756a82b81294b5b57ef3c66093befd38401aca38c86228d6f38a5a66WordPress NextEnd Connect plugin version 1.5.4 suffers from a cross site scripting vulnerability.
8967112d4e0b087a9c98f874a79f8d302c634061fdc5641c6b3e1c707037d480The UI daemon in Apache Storm version 0.10.0-beta allows remote users to run arbitrary code as the user running the web server. With kerberos authentication this could allow impersonation of arbitrary users on other systems, including HDFS and HBase.
313d55800f3841429c6c7e4111fca886753cb1e18bac2ecc4196684e7d19c6a2Gentoo Linux Security Advisory 201506-4 - Multiple vulnerabilities have been fixed in Chromium, the worst of which can cause arbitrary remote code execution. Versions less than 43.0.2357.65 are affected.
957476c058c044db28e980b30ae0cae33a242da1ea10d77234f3541a8006016cUbuntu Security Notice 2651-1 - Jakub Wilk discovered that GNU patch did not correctly handle file paths in patch files. An attacker could specially craft a patch file that could overwrite arbitrary files with the privileges of the user invoking the program. This issue only affected Ubuntu 12.04 LTS. Laszlo Boszormenyi discovered that GNU patch did not correctly handle some patch files. An attacker could specially craft a patch file that could cause a denial of service. Various other issues were also addressed.
e43ff81e4eac19b638143530ecd655f45f29338ebb1060483b4634127142c235Gentoo Linux Security Advisory 201506-3 - Multiple vulnerabilities have been fixed in GnuTLS, the worst of which can cause Denial of Service. Versions less than 3.3.15 are affected.
0adfa249575677c9d1c80449549fb0e096bbb61f049168a097fb63ed6f005d71Gentoo Linux Security Advisory 201506-2 - Multiple vulnerabilities have been found in OpenSSL that can result in either Denial of Service or information disclosure. Versions less than 1.0.1o are affected.
b959832120295fdb5bd555f5691546a5d3d9c082cbb839a74bf11f43345d673fUbuntu Security Notice 2640-2 - The Fix for CVE-2015-1328 introduced a regression into the Linux kernel's overlayfs file system. The removal of a directory that only exists on the lower layer results in a kernel panic. Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system. Various other issues were also addressed.
697723b7199c741ae728da226f5bebcdcee68c66ea47a4362db06cd672ac6bf3Gentoo Linux Security Advisory 201506-1 - Multiple vulnerabilities have been found in Adobe Flash Player, the worst of which allows remote attackers to execute arbitrary code. Versions less than 11.2.202.466 are affected.
36dce6b22065c49f042cfb2fdc6d8713a73b6834f0c321a35035a7f6002d7abdUbuntu Security Notice 2646-2 - The Fix for CVE-2015-1328 introduced a regression into the Linux kernel's overlayfs file system. The removal of a directory that only exists on the lower layer results in a kernel panic. Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system. Various other issues were also addressed.
c7380d91baf0065b79685c232e5e5e2202d948f49edf549da8ad314856cd6ce3Ubuntu Security Notice 2644-2 - The Fix for CVE-2015-1328 introduced a regression into the Linux kernel's overlayfs file system. The removal of a directory that only exists on the lower layer results in a kernel panic. Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system. Various other issues were also addressed.
369222ceb6590020b1886ad884d11700b41c94fa8ea8a7d63f869a68478feba4Ubuntu Security Notice 2643-2 - The Fix for CVE-2015-1328 introduced a regression into the Linux kernel's overlayfs file system. The removal of a directory that only exists on the lower layer results in a kernel panic. Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system. Various other issues were also addressed.
869ab9fcf03b2b3d337d915edb3a01426458905b77264337fe0d1729ac758123Ubuntu Security Notice 2642-2 - The Fix for CVE-2015-1328 introduced a regression into the Linux kernel's overlayfs file system. The removal of a directory that only exists on the lower layer results in a kernel panic. Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system. Various other issues were also addressed.
0b25925f01216f67d0afe0e7b5c7868672e9816c3ae053c9f217e953c39e477aUbuntu Security Notice 2641-2 - The Fix for CVE-2015-1328 introduced a regression into the Linux kernel's overlayfs file system. The removal of a directory that only exists on the lower layer results in a kernel panic. Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system. Various other issues were also addressed.
96a20eaa0b469006860a8f807d961c9932f2e95a258abdc96e1c6ae1be1a9810The symmetric-key encryption used in Tutanota is vulnerable to ciphertext malleability (a.k.a. arbitrary bit rewriting), since they fail to authenticate their ciphertexts.
00f4d00f46d790844e3f65ca4d008f1940000c4fbc31fee4ddcc2012120e85aeDebian Linux Security Advisory 3292-1 - Bastian Blank from credativ discovered that cinder, a storage-as-a-service system for the OpenStack cloud computing suite, contained a bug that would allow an authenticated user to read any file from the cinder server.
9b66ae4edb170f5a91d3494b9e622d7c412e83ebfeeb4f301dd56c81b5a97e05Duo push authentications are susceptible to a low-profile timing-based attack that permits an intruder to steal an authenticated session from an end-user accessing Duo-protected resources. Specifically, when multiple push notifications arrive simultaneously (or nearly so), only the final one is shown to the user. When the user authenticates that notification, only the corresponding session will actually be authenticated. If an attacker can initiate an equivalent connection slightly after the client?s session, then the user will typically authorize the malicious session rather than his or her own. Configurations affected include Duo Security Authentication Proxy version 2.4.8 and Duo Win Login version 1.1.8.
103eb43f4540ebf657dd6624630bfe6d9cf75eb31d994d75465d0101fe86aa75OpenEMR versions 4.2.0 and 4.2.0 patch 1 suffer from an authentication bypass vulnerability.
a589315de279dd22ee99c036b36a4cfd6f70531f2f25bab5afeaec7ef31766f6Red Hat Security Advisory 2015-1127-02 - In accordance with the Red Hat Enterprise Linux OpenStack Platform Support Policy, the life cycle of Production Support for version 4 will end on June 19, 2015. On June 20, 2015, Red Hat Enterprise Linux OpenStack Platform version 4 will enter an inactive state and will no longer receive updated packages, including Critical-impact security patches or urgent-priority bug fixes. In addition, technical support through Red Hat's Global Support Services will no longer be provided after this date.
71fc3ccc8a75ebf651126029495fe0d0bed9e150ed78b62c21f07ec3f910ae05SAP Mobile Platform version 3.0 suffers from an XXE injection vulnerability. The problem is caused by a program error due to the incorrect use of an XML parser (/mobiliser servlet). By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed. This malicious content can reference internal resources, such as files. These internal resources can be disclosed in the response to the request, or can be used to perform a denial of service attack on the parsing system, rendering the application content temporarily unavailable.
e89aaed13c5a2c5ac4e974c044a080f19bad90ce384d9fca4ba8d2c791e1c274SYBASE SQL Anywhere versions 12 and 16 suffer from a denial of service vulnerability. An attacker can trigger a condition in which the process ceases to run. This condition can be intentionally provoked by an attacker to cause denial of service.
ef63dab3201ae56b98a3747344e684a2c732c5d74e07e8556040954ed9c8255fSAP Afaria version 7 suffers from a missing authorization check vulnerability. An attacker can use a missing authorization check to access the service without any authorization procedures and use service functionality that has restricted access. This can lead to information disclosure, privilege escalation, and other attacks.
c31ed536e135ffd5dbbb2b9995e77c71bf0e3b40facee2e84ca09d91541fb8f9SAP Afaria version 7 suffers from a denial of service vulnerability in the XcListener module XeClient.Dll.
4503c9ec3011161fd5c3290385f680e3e08aa75980cccaccad5ba5c7f657478fThe management console of SAP NW version 7.4 suffers from an information disclosure vulnerability. It is possible to get some information from the web interface of CCMS without authentication. An attacker can use the information for subsequent attacks which will lead to illegal access to business-critical information.
73f02099e08e2e93992dacd4aa1f75a2d6f6808869ba2d42d24272d2af5847e5SAP NetWeaver Portal version 7.31 suffers from an XXE injection vulnerability. By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed. This malicious content can reference internal resources, such as files. These internal resources can be disclosed in the response to the request, or can be used to perform a denial of service attack on the parsing system, rendering the application content temporarily unavailable.
b46458ceeb29478ddffbd1e176b6e2695088708178f75445d879b1a591dbce9f
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed