exploit the possibilities
Showing 1 - 25 of 27 RSS Feed

Files Date: 2013-06-27

Apache Santuario XML Security For C++ Heap Overflow
Posted Jun 27, 2013
Authored by Jon Erickson

The attempted fix to address CVE-2013-2154 introduced the possibility of a heap overflow, possibly leading to arbitrary code execution, in the processing of malformed XPointer expressions in the XML Signature Reference processing code. An attacker could use this to exploit an application performing signature verification if the application does not block the evaluation of such references prior to performing the verification step. The exploit would occur prior to the actual verification of the signature, so does not require authenticated content. Apache Santuario XML Security for C++ library versions prior to 1.7.2 are affected.

tags | advisory, overflow, arbitrary, code execution
advisories | CVE-2013-2154, CVE-2013-2210
SHA-256 | ed557eaf432b8220b8a580b3a0a313162a1d2211f6e1ea637a19dc2d29e16038
HP Security Bulletin HPSBUX02886
Posted Jun 27, 2013
Authored by HP | Site hp.com

HP Security Bulletin HPSBUX02886 - A potential security vulnerability has been identified with HP-UX running HP Secure Shell. The vulnerability could be exploited remotely to create a Denial of Service (DoS). Revision 1 of this advisory.

tags | advisory, denial of service, shell
systems | hpux
advisories | CVE-2010-5107
SHA-256 | cac1fdeec8a55f1c45ad6c9cca7c998c11e3e1e01ed4039be8e9ca602e7613b0
HP Security Bulletin HPSBST02890
Posted Jun 27, 2013
Authored by HP | Site hp.com

HP Security Bulletin HPSBST02890 - A potential security vulnerability has been identified with HP StoreOnce D2D Backup System. The vulnerability could be exploited remotely resulting in unauthorized access and modification. Please note that this issue does not affect HP StoreOnce Backup systems that are running software version 3.0.0 or newer. Devices running software version 3.0.0 or newer do not have a HPSupport user account with a pre-set password configured. A user who is logged in via the HPSupport user account does not have access to the data that has been backed up to the HP StoreOnce Backup system, and hence is not able to read or download the backed up data. However, it is possible to reset the device to factory defaults, and hence delete all backed up data that is present on the device. Revision 1 of this advisory.

tags | advisory
advisories | CVE-2013-2342
SHA-256 | 836f157ebc6e5df575b140451776908b9f5ec88b67f885a256788ec84f8a2a59
Red Hat Security Advisory 2013-0992-01
Posted Jun 27, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0992-01 - Python-keystoneclient is the client library and command line utility for interacting with the OpenStack identity API. A flaw was found in the way python-keystoneclient handled encrypted data from memcached. Even when the memcache_security_strategy setting in "/etc/swift/proxy-server.conf" was set to ENCRYPT to help prevent tampering, an attacker on the local network, or possibly an unprivileged user in a virtual machine hosted on OpenStack, could use this flaw to bypass intended restrictions and modify data in memcached that will later be used by services utilizing python-keystoneclient.

tags | advisory, local, python
systems | linux, redhat
advisories | CVE-2013-2166, CVE-2013-2167
SHA-256 | 0b46ee70e661aac86fcfce7d4bfb6636c8819246323ca5bac1086eda68288cae
Red Hat Security Advisory 2013-0997-01
Posted Jun 27, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0997-01 - This is the 5-Month notification of the End Of Life plans for Red Hat Storage Software Appliance 3.2 and Red Hat Virtual Storage Software Appliance 3.2. In accordance with the Red Hat Storage Software Appliance Support Life Cycle Policy, support will end on November 30, 2013. Red Hat will not provide extended support for this product. Customers are requested to migrate to the newer Red Hat Storage Server product once the life cycle for SSA and VSA is complete. If customers cannot migrate, the product will become unsupported. In addition, after November 30, 2013, technical support through Red Hat’s Global Support Services will no longer be provided. We encourage customers to plan their migration from Storage Software Appliance 3.2 to the latest version of Red Hat Storage Server. Please contact your Red Hat account representative if you have questions and/or concerns on this matter.

tags | advisory
systems | linux, redhat
SHA-256 | f027ef4acb05402b88530668fa3538e2e6c30aefee4fda63be63ff6f1ef48acc
Red Hat Security Advisory 2013-0993-01
Posted Jun 27, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0993-01 - OpenStack Swift is a highly available, distributed, eventually consistent object/blob store. An XML injection flaw in OpenStack Swift could allow remote attackers to manipulate the contents of XML responses via specially-crafted data. This could be used to trigger a denial of service.

tags | advisory, remote, denial of service, xxe
systems | linux, redhat
advisories | CVE-2013-2161
SHA-256 | 28a8b98698ba460b04f7bcbc2c2b29b15adacb9c2f421378f5d59be53638b7c8
Red Hat Security Advisory 2013-0996-01
Posted Jun 27, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0996-01 - In accordance with the Red Hat Enterprise Linux Errata Support Policy, Extended Update Support for Red Hat Enterprise Linux 5.6 will be retired on July 31, 2013, and support will no longer be provided. Accordingly, Red Hat will no longer provide updated packages, including critical impact security patches or urgent priority bug fixes, for Red Hat Enterprise Linux 5.6 EUS after that date. In addition, after July 31, 2013, technical support through Red Hat's Global Support Services will no longer be provided. Note: This notification applies only to those customers subscribed to the Extended Update Support channel for Red Hat Enterprise Linux 5.6.

tags | advisory
systems | linux, redhat
SHA-256 | 8b83fe4c652ad4ec0b42ead3c74029eeef6a895684a862769aa70d58e2be94e5
Red Hat Security Advisory 2013-0994-01
Posted Jun 27, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0994-01 - The openstack-keystone packages provide Keystone, a Python implementation of the OpenStack identity service API, which provides Identity, Token, Catalog, and Policy services. A flaw was found in the way Keystone handled LDAP based authentication. If Keystone was configured to use LDAP authentication, and the LDAP server was configured to allow anonymous binds, anyone able to connect to a given service using Keystone could connect as any user, including the admin, without supplying a password.

tags | advisory, python
systems | linux, redhat
advisories | CVE-2013-2157
SHA-256 | 32c7604db4e8db147fcbddd83a091aa60f03d25791155e16d28b79f42a471506
Red Hat Security Advisory 2013-0995-01
Posted Jun 27, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0995-01 - A flaw was found in the create method of the Foreman Bookmarks controller. A user with privileges to create a bookmark could use this flaw to execute arbitrary code with the privileges of the user running Foreman, giving them control of the system running Foreman and all systems managed by Foreman.

tags | advisory, arbitrary
systems | linux, redhat
advisories | CVE-2013-2113, CVE-2013-2121
SHA-256 | a6ea90b4ec301210ea27cf545a21cf478f09de9e3ff6fc69ffd8f53ff3497b99
Debian Security Advisory 2715-1
Posted Jun 27, 2013
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2715-1 - It was discovered that puppet, a centralized configuration management system, did not correctly handle YAML payloads. A remote attacker could use a specially-crafted payload to execute arbitrary code on the puppet master.

tags | advisory, remote, arbitrary
systems | linux, debian
advisories | CVE-2013-3567
SHA-256 | fd2dc8e5853dbe33e218f6b50151a763e0ba4dd4cf9901134c0e021f9d1edac1
Ubuntu Security Notice USN-1893-1
Posted Jun 27, 2013
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1893-1 - Alexander Klink discovered that the Subversion mod_dav_svn module for Apache did not properly handle a large number of properties. A remote authenticated attacker could use this flaw to cause memory consumption, leading to a denial of service. Ben Reser discovered that the Subversion mod_dav_svn module for Apache did not properly handle certain LOCKs. A remote authenticated attacker could use this flaw to cause Subversion to crash, leading to a denial of service. Various other issues were also addressed.

tags | advisory, remote, denial of service
systems | linux, ubuntu
advisories | CVE-2013-1845, CVE-2013-1846, CVE-2013-1847, CVE-2013-1849, CVE-2013-1884, CVE-2013-1968, CVE-2013-2112, CVE-2013-1845, CVE-2013-1846, CVE-2013-1847, CVE-2013-1849, CVE-2013-1884, CVE-2013-1968, CVE-2013-2112
SHA-256 | fadad9d01a7a48363d8538dad2db68b65dffa4ac54afcd7eeb83be412b82d57b
Ubuntu Security Notice USN-1892-1
Posted Jun 27, 2013
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1892-1 - It was discovered that ubuntu-release-upgrader would fail when a user requested an upgrade to Ubuntu 13.04. This would prevent a user from migrating easily to Ubuntu 13.04 before the Ubuntu 12.10 support period ended.

tags | advisory
systems | linux, ubuntu
SHA-256 | c45c0cfedb56dfcb1b096118732bb29d017bc74a99184bfb68ea3a9190520815
Mandriva Linux Security Advisory 2013-185
Posted Jun 27, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-185 - Updated perl-Module-Signature package fixes CVE-2013-2145. Arbitrary code execution vulnerability in Module::Signature before 0.72.

tags | advisory, arbitrary, perl, code execution
systems | linux, mandriva
advisories | CVE-2013-2145
SHA-256 | c7e5d5ed176a33a19145b6155e1725b3cb982169c35e3e86fd5f5833bf0d01e6
Mandriva Linux Security Advisory 2013-184
Posted Jun 27, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-184 - Updated perl-Dancer package fixes CVE-2012-5572. A security flaw was found in the way Dancer.pm, lightweight yet powerful web application framework / Perl language module, performed sanitization of values to be used for cookie() and cookies() methods. A remote attacker could use this flaw to inject arbitrary headers into responses from applications, that use Dancer.pm.

tags | advisory, remote, web, arbitrary, perl
systems | linux, mandriva
advisories | CVE-2012-5572
SHA-256 | 5e4cd0dafb01b5590970bbb3187e0e97b40f6c3f624e3f8d33655f466899e46f
Mandriva Linux Security Advisory 2013-183
Posted Jun 27, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-183 - Updated java-1.7.0-openjdk packages fix multiple security vulnerabilities. Multiple flaws were discovered in the ImagingLib and the image attribute, channel, layout and raster processing in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption. Integer overflow flaws were found in the way AWT processed certain input. An attacker could use these flaws to execute arbitrary code with the privileges of the user running an untrusted Java applet or application. Various other issues were addressed.

tags | advisory, java, overflow, arbitrary, vulnerability
systems | linux, mandriva
advisories | CVE-2013-1500, CVE-2013-1571, CVE-2013-2407, CVE-2013-2412, CVE-2013-2443, CVE-2013-2444, CVE-2013-2445, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2449, CVE-2013-2450, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2458, CVE-2013-2459, CVE-2013-2460, CVE-2013-2461, CVE-2013-2463, CVE-2013-2465, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472
SHA-256 | 3bc21ccc47d661daa96394b723e72056e5e5367a29aeae7693f91c800dd74b49
Mandriva Linux Security Advisory 2013-182
Posted Jun 27, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-182 - Updated mesa packages fix multiple vulnerabilities. An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs (Mozilla Firefox does this), an attacker could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. It was found that Mesa did not correctly validate messages from the X server. A malicious X server could cause an application using Mesa to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

tags | advisory, arbitrary, vulnerability
systems | linux, mandriva
advisories | CVE-2013-1872, CVE-2013-1993
SHA-256 | a90b8aaa0be2c76505077698e6b25ae7036e5269415ca1a9259e114ff2f855f1
Mandriva Linux Security Advisory 2013-181
Posted Jun 27, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-181 - Multiple integer overflows in X.org libGLX in Mesa 9.1.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XF86DRIOpenConnection and XF86DRIGetClientDriverName functions. The updated packages have been patched to correct this issue.

tags | advisory, overflow
systems | linux, mandriva
advisories | CVE-2013-1993
SHA-256 | a4beeeb10e775810693019d4dc5ba38575cb1e9c3f90070c99872a9c19730354
Mandriva Linux Security Advisory 2013-180
Posted Jun 27, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-180 - libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption. The function curl_easy_unescape() decodes URL encoded strings to raw binary data. URL encoded octets are represented with \%HH combinations where HH is a two-digit hexadecimal number. The decoded string is written to an allocated memory area that the function returns to the caller. The updated packages have been patched to correct this issue.

tags | advisory
systems | linux, mandriva
advisories | CVE-2013-2174
SHA-256 | 8930cdf17b729214cd1f709f26c69dc0640e1825f1cf4dcfb9fa79a62710a602
Digital Satellite Receiver And Safety
Posted Jun 27, 2013
Authored by Tacettin Karadeniz

This is a whitepaper called Digital Satellite Receiver and Safety. Written in Turkish.

tags | paper
SHA-256 | d7cc66e8f99debfec1f75708fbfa4198805f1c26fc1e85a0a541cd7c1cd2a814
Java Applet ProviderSkeleton Insecure Invoke Method
Posted Jun 27, 2013
Authored by Adam Gowdiak, Matthias Kaiser | Site metasploit.com

This Metasploit module abuses the insecure invoke() method of the ProviderSkeleton class that allows to call arbitrary static methods with user supplied arguments. The vulnerability affects Java version 7u21 and earlier.

tags | exploit, java, arbitrary
advisories | CVE-2013-2460, OSVDB-94346
SHA-256 | 4c7f2d07b2fb9904b25b6805e68094ce81bd292f4e93feb4b36e0f249b1ace06
Cisco Security Advisory 20130626-ngfw
Posted Jun 27, 2013
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - Cisco ASA Next-Generation Firewall (NGFW) Services contains a Fragmented Traffic Denial of Service (DoS) vulnerability. Successful exploitation of this vulnerability on the Cisco ASA NGFW could cause the device to reload or stop processing user traffic that has been redirected by the parent Cisco ASA to the ASA NGFW module for further inspection. There are no workarounds for this vulnerability, but mitigations are available. Cisco has released free software updates that address this vulnerability.

tags | advisory, denial of service
systems | cisco
SHA-256 | ec64974b2ac07ab492e1a5dfadb995c59febd0ac9849aedd50b4abf8aa81eb7b
Cisco Security Advisory 20130626-sma
Posted Jun 27, 2013
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - Cisco IronPort AsyncOS Software for Cisco Content Security Management Appliance is affected by command injection and denial of service vulnerabilities. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available.

tags | advisory, denial of service, vulnerability
systems | cisco
SHA-256 | 3fc7baaa77ed48d81b4f09eba8467c1626fa1a90dd426aa437bd73366e18973a
Ubuntu Security Notice USN-1891-1
Posted Jun 27, 2013
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1891-1 - Multiple memory safety issues were discovered in Thunderbird. If the user were tricked into opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Thunderbird. Abhishek Arya discovered multiple use-after-free bugs. If the user were tricked into opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to execute arbitrary code with the privileges of the user invoking Thunderbird. CVE-2013-1685,CVE-2013-1686) Various other issues were also addressed.

tags | advisory, denial of service, arbitrary
systems | linux, ubuntu
advisories | CVE-2013-1682, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1690, CVE-2013-1692, CVE-2013-1693, CVE-2013-1694, CVE-2013-1697, CVE-2013-1682, CVE-2013-1684, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1690, CVE-2013-1692, CVE-2013-1693, CVE-2013-1694, CVE-2013-1697
SHA-256 | 3ed99560bfcc1801f775973b6f002c03a20fca98adaee9a2e0e5b6eeac71f887
Debian Security Advisory 2716-1
Posted Jun 27, 2013
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2716-1 - Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser. Multiple memory safety errors, use-after-free vulnerabilities, missing permission checks, incorrect memory handling and other implementation errors may lead to the execution of arbitrary code, privilege escalation, information disclosure or cross-site request forgery.

tags | advisory, web, arbitrary, vulnerability, info disclosure, csrf
systems | linux, debian
advisories | CVE-2013-1682, CVE-2013-1684, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1690, CVE-2013-1692, CVE-2013-1693, CVE-2013-1694, CVE-2013-1697
SHA-256 | 5ebe91542f6fe7da0420bd343e5011912bd953cd6de2607de103d318b6008305
Ubuntu Security Notice USN-1890-1
Posted Jun 27, 2013
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1890-1 - Multiple memory safety issues were discovered in Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. Abhishek Arya discovered multiple use-after-free bugs. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to execute arbitrary code with the privileges of the user invoking Firefox. Various other issues were also addressed.

tags | advisory, denial of service, arbitrary
systems | linux, ubuntu
advisories | CVE-2013-1687, CVE-2013-1688, CVE-2013-1690, CVE-2013-1692, CVE-2013-1693, CVE-2013-1694, CVE-2013-1695, CVE-2013-1696, CVE-2013-1697, CVE-2013-1698, CVE-2013-1699, CVE-2013-1682, CVE-2013-1683, CVE-2013-1684, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1688, CVE-2013-1690, CVE-2013-1692, CVE-2013-1693, CVE-2013-1694, CVE-2013-1695, CVE-2013-1696, CVE-2013-1697, CVE-2013-1698, CVE-2013-1699
SHA-256 | ac94c2cd9ce8eb413dd2b48e8bd494ce46fe84e71be3a9fb57c00d03ebbeeaff
Page 1 of 2
Back12Next

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    26 Files
  • 18
    May 18th
    4 Files
  • 19
    May 19th
    17 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close