Cisco Security Advisory - A vulnerability in the Internet Key Exchange (IKE) version 1 (v1) code of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause an affected system to reload. The vulnerability is due to improper handling of Internet Security Association and Key Management Protocol (ISAKMP) packets. An attacker could exploit this vulnerability by sending crafted UDP packets to the affected system. A successful exploit could allow the attacker to cause an affected system to reload.
7d4c5d946c180d7db530886cb28a882fa6b9283d15f09d4167f604144f2962a9Cisco Security Advisory - A vulnerability in the DNS code of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause an affected system to reload. The vulnerability is due to improper processing of DNS packets. An attacker could exploit this vulnerability by sending a request to an affected Cisco ASA appliance to cause it to generate a DNS request packet. The attacker would need to spoof the reply packet with a crafted DNS response.
5ee7857505fa994098c9c9e4ce490ca05c88b03d2bf0c2ad43f540c2734e5f58Cisco Security Advisory - A vulnerability in the DHCPv6 relay feature of Cisco Adaptive Security Appliance (ASA) software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient validation of DHCPv6 packets. Cisco ASA Software is affected by this vulnerability only if the software is configured with the DHCPv6 relay feature. An attacker could exploit this vulnerability by sending crafted DHCPv6 packets to an affected device.
3f9de37e2bd0d6154ff3b114a4806263fcf7f098d579b9784472780cdab25a3cCisco Security Advisory - A vulnerability in the DHCPv6 relay feature of Cisco Adaptive Security Appliance (ASA) software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient validation of DHCPv6 packets. Cisco ASA Software is affected by this vulnerability only if the software is configured with the DHCPv6 relay feature. An attacker could exploit this vulnerability by sending crafted DHCPv6 packets to an affected device.
3cc98d2dc398f7a9e51ff5963ef2b4bfe4df15fb4b805490adacbb8b168d210cUbuntu Security Notice 2770-2 - USN-2770-1 fixed vulnerabilities in Oxide in Ubuntu 14.04 LTS and Ubuntu 15.04. This update provides the corresponding updates for Ubuntu 15.10. It was discovered that ContainerNode::parserInsertBefore in Blink would incorrectly proceed with a DOM tree insertion in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. A use-after-free was discovered in the service worker implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. Various other issues were also addressed.
cc7ff3720ed49e1a8614059f8624fd170ac675d3c067ed96ba831eff2cb7f5c1Red Hat Security Advisory 2015-1924-01 - KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance or potentially execute arbitrary code on the host.
57efea710eb0a005d7e1005b14e3ee253ed6fea58cad65476af25481bb094aabRed Hat Security Advisory 2015-1925-01 - KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance or potentially execute arbitrary code on the host.
34474d4388dd63016e4f02e85c330f5170d5ff26ef1d9a1683efbba058d5b9f2Red Hat Security Advisory 2015-1923-01 - KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM. A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance or potentially execute arbitrary code on the host.
f012e9ccacba8f64dd5aab7e0ae3942dd803d745e77056bb3a70aaf782bcb6efRed Hat Security Advisory 2015-1920-01 - The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed.
9ac18bfdf04382d72ffee12d18413d5e56c5159d29a01fbfecafa03341a81c10Red Hat Security Advisory 2015-1921-01 - The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed.
14928189fc53248a9ff8eeea22f0708da21860ebd6b0655af037f636a10b3bbfDebian Linux Security Advisory 3376-1 - Several vulnerabilities have been discovered in the chromium web browser.
c2fb639f121d86a50280fee2d1e8efc29647ec5574df20fecf40a4dcbfeaf827Apple Security Advisory 2015-10-21-8 - OS X Server 5.0.15 is now available and addresses BIND and bypass vulnerabilities.
412ab3e71955416d2cd012b8f149b98e2a4f5c4bbbe6020dfd2cfa90f0615729Apple Security Advisory 2015-10-21-7 - Xcode 7.1 is now available and addresses a type conversion issue.
8829893715fa55a2d3cfd939e58b8d600e788d936726ed5f26c9c00d30d4ec77Apple Security Advisory 2015-10-21-6 - Mac EFI Security Update 2015-002 is now available and addresses an accessible function issue.
81dff8947bbabdf3af041ab14489b09ec25660e94a41302ad63123f606324393Apple Security Advisory 2015-10-21-5 - iTunes 12.3.1 is now available and addresses multiple memory corruption vulnerabilities.
63fc1ae7492cff25005f313015f56cd3c31cf5cb82252a94357d21d3ef7330c2Apple Security Advisory 2015-10-21-4 - OS X El Capitan 10.11.1 and Security Update 2015-007 are now available and address memory corruption, code execution, and various other vulnerabilities.
29b89a7f94c21f47037df252cf87e2917cad436a38b6f9faf840a0c7ee609335Apple Security Advisory 2015-10-21-3 - Safari 9.0.1 is now available and addresses multiple memory corruption vulnerabilities.
5908ea999e8d97dc41ddc68a307ffb8b34c1beaafe3e6de555e76c95bb19935cCisco Security Advisory - Multiple Cisco products incorporate a version of the ntpd package. Versions of this package are affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition or modify the time being advertised by a device acting as a network time protocol (NTP) server. On October 21st, 2015, NTP.org released a security advisory detailing 13 issues regarding multiple DoS vulnerabilities, information disclosure vulnerabilities, and logic issues that may result in an attacker gaining the ability to modify an NTP server's advertised time.
6ebc284ba57243b45f2bce8db6f2a2f67c881ca4c1e93c7fa6a8b5eff989e55aApple Security Advisory 2015-10-21-2 - watchOS 2.0.1 is now available and addresses arbitrary code execution, heap buffer overflow, and various other vulnerabilities.
b5fed81d5b6693b68f892dc91bbaa73fd5b0465588a6086b31825b77a194c21cApple Security Advisory 2015-10-21-1 - iOS 9.1 is now available and addresses arbitrary code execution, cookies being overwritten, heap based buffer overflow, and various other vulnerabilities.
dd5e6a9416d9e971b2e3f787976bc2659a2ded06a1e7d6a8896e91cda4316e25Debian Linux Security Advisory 3375-1 - Several vulnerabilities have been fixed in Wordpress, the popular blogging engine.
962d2875a78d737cfb101fb44e50e4e9c3fb86322f3f4dc9f6fc680b5a969da2Ubuntu Security Notice 2775-1 - It was discovered that the Linux kernel did not check if a new IPv6 MTU set by a user space application was valid. A remote attacker could forge a route advertisement with an invalid MTU that a user space daemon like NetworkManager would honor and apply to the kernel, causing a denial of service. It was discovered that virtio networking in the Linux kernel did not handle fragments correctly, leading to kernel memory corruption. A remote attacker could use this to cause a denial of service (system crash) or possibly execute code with administrative privileges. Various other issues were also addressed.
eccf6cc9f1ecdd21da7422357b7edd8ff051eb42b235c47f08d7bd23dc2a4c85Ubuntu Security Notice 2780-1 - Aleksandar Nikolic discovered a buffer overflow vulnerability in the XML parser functionality of the MiniUPnP library. A remote attacker could use this to cause a denial of service (application crash) or possibly execute arbitrary code with privileges of the user running an application that uses the MiniUPnP library.
afd5865ef1963ee7a26e07db611c821c91f0a869b605a50e748e72c46647c46fRed Hat Security Advisory 2015-1918-01 - Red Hat Gluster Storage is a software only scale-out storage solution that provides flexible and affordable unstructured data storage. It unifies data storage and infrastructure, increases performance, and improves availability and manageability to meet enterprise-level storage challenges. Red Hat Gluster Storage's Unified File and Object Storage is built on OpenStack's Object Storage. A flaw was found in the way swiftonfile serialized and stored metadata on disk by using Python's pickle module. A remote, authenticated user could use this flaw to execute arbitrary code on the storage node.
709cbd1bab7f62d94310341c0c6c4d1a89f6bdc96d221a02d70283dc5b7f71c5Ubuntu Security Notice 2778-1 - It was discovered that the Linux kernel did not check if a new IPv6 MTU set by a user space application was valid. A remote attacker could forge a route advertisement with an invalid MTU that a user space daemon like NetworkManager would honor and apply to the kernel, causing a denial of service. It was discovered that virtio networking in the Linux kernel did not handle fragments correctly, leading to kernel memory corruption. A remote attacker could use this to cause a denial of service (system crash) or possibly execute code with administrative privileges. Various other issues were also addressed.
9c92de288e4eb7656ebb3bde7fa0705f4dc4d5ebeab54a345c58b7a9fe60d2d6
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed