ignore security and it'll go away
Showing 1 - 25 of 33 RSS Feed

Files Date: 2014-06-25

G Data TotalProtection 2014 Code Execution
Posted Jun 25, 2014
Authored by Kyriakos Economou | Site portcullis-security.com

G Data TotalProtection 2014 version 24.0.2.1 suffers from an arbitrary code execution vulnerability.

tags | advisory, arbitrary, code execution
advisories | CVE-2014-3752
MD5 | eaf678b5f91e58bb6893825ee79fe3e0
FreeBSD Security Advisory - file / libmagic
Posted Jun 25, 2014
Site security.freebsd.org

FreeBSD Security Advisory - The file(1) utility attempts to classify file system objects based on filesystem, magic number and language tests. The libmagic(3) library provides most of the functionality of file(1) and may be used by other applications. A specifically crafted Composite Document File (CDF) file can trigger an out-of-bounds read or an invalid pointer dereference. A flaw in regular expression in the awk script detector makes use of multiple wildcards with unlimited repetitions. A malicious input file could trigger infinite recursion in libmagic(3). A specifically crafted Portable Executable (PE) can trigger out-of-bounds read.

tags | advisory
systems | freebsd
advisories | CVE-2012-1571, CVE-2013-7345, CVE-2014-1943, CVE-2014-2270
MD5 | 1dc0c3fbf70438e2a2b1a9f541cd9a65
FreeBSD Security Advisory - iconv NULL Pointer Dereference
Posted Jun 25, 2014
Site security.freebsd.org

FreeBSD Security Advisory - A NULL pointer dereference in the initialization code of the HZ module and an out of bounds array access in the initialization code of the VIQR module make iconv_open(3) calls involving HZ or VIQR result in an application crash.

tags | advisory
systems | freebsd
advisories | CVE-2014-3951
MD5 | a18b69584636b226071cb9d556ae6020
Endeca Latitude 2.2.2 Cross Site Scripting
Posted Jun 25, 2014
Site redteam-pentesting.de

RedTeam Pentesting discovered a cross site scripting vulnerability in Endeca Latitude version 2.2.2. By exploiting this vulnerability an attacker is able to execute arbitrary JavaScript code in the context of other Endeca Latitude users.

tags | exploit, arbitrary, javascript, xss
advisories | CVE-2014-2400
MD5 | 8e9a895e532aebf33732d79e3c08ab34
Endeca Latitude 2.2.2 Cross Site Request Forgery
Posted Jun 25, 2014
Site redteam-pentesting.de

RedTeam Pentesting discovered a cross site request forgery vulnerability in Endeca Latitude version 2.2.2. Using this vulnerability, an attacker might be able to change several different settings of the Endeca Latitude instance or disable it entirely.

tags | exploit, csrf
advisories | CVE-2014-2399
MD5 | a099404c5b9c1eedb4be103a04129511
Storesprite 7 Cross Site Scripting
Posted Jun 25, 2014
Authored by High-Tech Bridge SA | Site htbridge.com

Storesprite version 7 suffers from a cross site scripting vulnerability.

tags | exploit, xss
MD5 | 0eb1afa0015163ad4bb4535a36cc8532
HITB Malaysia 2014 Call For Papers
Posted Jun 25, 2014
Site cfp.hackinthebox.org

The Call For Papers for the 12th annual HITB security conference in Malaysia has been announced. It will take place October 13th through the 16th, 2014, in Kuala Lumpur.

tags | paper, conference
MD5 | 257d61fd3a5d0065565a23cbd109e610
Gentoo Linux Security Advisory 201406-23
Posted Jun 25, 2014
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201406-23 - A vulnerability in DenyHosts could allow a remote attacker to create a Denial of Service condition. Versions less than 2.6-r9 are affected.

tags | advisory, remote, denial of service
systems | linux, gentoo
advisories | CVE-2013-6890
MD5 | d79281384c3cf1afb201045b8c40e671
Gentoo Linux Security Advisory 201406-24
Posted Jun 25, 2014
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201406-24 - A vulnerability in Dnsmasq can lead to a Denial of Service condition. Versions less than 2.66 are affected.

tags | advisory, denial of service
systems | linux, gentoo
advisories | CVE-2012-3411, CVE-2013-0198
MD5 | f4574c3df6ac901aafbbaf9331119ccf
Ubuntu Security Notice USN-2256-1
Posted Jun 25, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2256-1 - John Dickinson discovered that Swift did not properly quote the WWW-Authenticate header value. If a user were tricked into navigating to a malicious Swift URL, an attacker could conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.

tags | advisory, remote, vulnerability, xss
systems | linux, ubuntu
advisories | CVE-2014-3497
MD5 | e35591f1b2c5942a778396231427b3c3
Ubuntu Security Notice USN-2255-1
Posted Jun 25, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2255-1 - Darragh O'Reilly discovered that the Ubuntu packaging for OpenStack Neutron did not properly set up its sudo configuration. If a different flaw was found in OpenStack Neutron, this vulnerability could be used to escalate privileges. Stephen Ma and Christoph Thiel discovered that the openvswitch-agent in OpenStack Neutron did not properly perform input validation when creating security group rules when specifying --remote-ip-prefix. A remote authenticated attacker could exploit this to prevent application of additional rules. Various other issues were also addressed.

tags | advisory, remote
systems | linux, ubuntu
advisories | CVE-2013-6433, CVE-2014-0187, CVE-2014-4167
MD5 | a1a631471baee752d4364eee785d3de6
VMware Security Advisory 2014-0007
Posted Jun 25, 2014
Authored by VMware | Site vmware.com

VMware Security Advisory 2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library.

tags | advisory, vulnerability
advisories | CVE-2014-0050, CVE-2014-0094, CVE-2014-0112
MD5 | 3595a99c468e3b216b6df603faaa858e
HP Security Bulletin HPSBMU03053
Posted Jun 25, 2014
Authored by HP | Site hp.com

HP Security Bulletin HPSBMU03053 - A potential security vulnerability has been identified with HP Software Database and Middleware Automation (DMA). This vulnerability could be exploited remotely to allow unauthorized access or disclosure of information. Revision 1 of this advisory.

tags | advisory
advisories | CVE-2014-0224
MD5 | 98dc205bae0584776b48fa590efdb0cd
HP Security Bulletin HPSBMU03051
Posted Jun 25, 2014
Authored by HP | Site hp.com

HP Security Bulletin HPSBMU03051 - Potential security vulnerabilities have been identified with HP System Management Homepage running OpenSSL on Linux and Windows. The vulnerabilities could be exploited remotely to create a Denial of Service (DoS), execute code, allow unauthorized access, or disclose information. Revision 1 of this advisory.

tags | advisory, denial of service, vulnerability
systems | linux, windows
advisories | CVE-2010-5298, CVE-2014-0076, CVE-2014-0195, CVE-2014-0198, CVE-2014-0221, CVE-2014-0224, CVE-2014-3470
MD5 | 854a1f36774eefb78b4e48e7864254e8
Slackware Security Advisory - samba Updates
Posted Jun 25, 2014
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New samba packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

tags | advisory
systems | linux, slackware
advisories | CVE-2014-0178, CVE-2014-0239, CVE-2014-0244, CVE-2014-3493
MD5 | 0ae40accca000d70ad492bdd532a5e38
Slackware Security Advisory - bind Updates
Posted Jun 25, 2014
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

tags | advisory
systems | linux, slackware
advisories | CVE-2013-6230, CVE-2014-0591
MD5 | 45be8e7ff850a35ae20f859b8d2ff4fa
Slackware Security Advisory - gnupg Updates
Posted Jun 25, 2014
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New gnupg packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue.

tags | advisory
systems | linux, slackware
advisories | CVE-2014-4617
MD5 | 41491c88330f3f9e2a0ca742046881c6
Slackware Security Advisory - gnupg2 Updates
Posted Jun 25, 2014
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New gnupg2 packages are available for Slackware 13.37, 14.0, 14.1, and -current to fix a security issue.

tags | advisory
systems | linux, slackware
advisories | CVE-2014-4617
MD5 | ef4b3a06bd444af4c5361e0810191a49
Gentoo Linux Security Advisory 201406-22
Posted Jun 25, 2014
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201406-22 - Multiple vulnerabilities have been found in Network Audio System, the worst of which allows remote attackers to execute arbitrary code. Versions less than 1.9.4 are affected.

tags | advisory, remote, arbitrary, vulnerability
systems | linux, gentoo
advisories | CVE-2013-4256, CVE-2013-4258
MD5 | aa200c45373bfe4467f3787ec877566c
Ubuntu Security Notice USN-2254-2
Posted Jun 25, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2254-2 - USN-2254-1 fixed vulnerabilities in PHP. The fix for CVE-2014-0185 further restricted the permissions on the PHP FastCGI Process Manager (FPM) UNIX socket. This update grants socket access to the www-data user and group so installations and documentation relying on the previous socket permissions will continue to function. Christian Hoffmann discovered that the PHP FastCGI Process Manager (FPM) set incorrect permissions on the UNIX socket. A local attacker could use this issue to possibly elevate their privileges. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. Francisco Alonso discovered that the PHP Fileinfo component incorrectly handled certain CDF documents. A remote attacker could use this issue to cause PHP to hang or crash, resulting in a denial of service. Stefan Esser discovered that PHP incorrectly handled DNS TXT records. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, denial of service, arbitrary, local, php, vulnerability
systems | linux, unix, ubuntu
advisories | CVE-2014-0185, CVE-2014-4049
MD5 | 293a0308b6ae2533dadaed4ae1b60dc7
Debian Security Advisory 2967-1
Posted Jun 25, 2014
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2967-1 - Jean-Rene Reinhard, Olivier Levillain and Florian Maury reported that GnuPG, the GNU Privacy Guard, did not properly parse certain garbled compressed data packets. A remote attacker could use this flaw to mount a denial of service against GnuPG by triggering an infinite loop.

tags | advisory, remote, denial of service
systems | linux, debian
advisories | CVE-2014-4617
MD5 | 374193d93b5448049a16c00ddd5fbe39
Red Hat Security Advisory 2014-0790-01
Posted Jun 25, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0790-01 - Dovecot is an IMAP server, written with security primarily in mind, for Linux and other UNIX-like systems. It also contains a small POP3 server. It supports mail in both the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. It was discovered that Dovecot did not properly discard connections trapped in the SSL/TLS handshake phase. A remote attacker could use this flaw to cause a denial of service on an IMAP/POP3 server by exhausting the pool of available connections and preventing further, legitimate connections to the IMAP/POP3 server to be made.

tags | advisory, remote, denial of service, imap
systems | linux, redhat, unix
advisories | CVE-2014-3430
MD5 | f72fa3d0e02a43263c34e61052b660d6
Red Hat Security Advisory 2014-0789-01
Posted Jun 25, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0789-01 - The mod_wsgi adapter is an Apache module that provides a WSGI-compliant interface for hosting Python-based web applications within Apache. It was found that mod_wsgi did not properly drop privileges if the call to setuid() failed. If mod_wsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system. Note: mod_wsgi is not intended to provide privilege separation for WSGI applications. Systems relying on mod_wsgi to limit or sandbox the privileges of mod_wsgi applications should migrate to a different solution with proper privilege separation.

tags | advisory, web, local, python
systems | linux, redhat
advisories | CVE-2014-0240
MD5 | 54153195fd11186bf237c6cfbbbd7432
Red Hat Security Advisory 2014-0788-01
Posted Jun 25, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0788-01 - The mod_wsgi adapter is an Apache module that provides a WSGI-compliant interface for hosting Python-based web applications within Apache. It was found that mod_wsgi did not properly drop privileges if the call to setuid() failed. If mod_wsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system. Note: mod_wsgi is not intended to provide privilege separation for WSGI applications. Systems relying on mod_wsgi to limit or sandbox the privileges of mod_wsgi applications should migrate to a different solution with proper privilege separation.

tags | advisory, web, local, python
systems | linux, redhat
advisories | CVE-2014-0240, CVE-2014-0242
MD5 | d19063f71582c6f68c3949d16bae8eb5
Red Hat Security Advisory 2014-0792-01
Posted Jun 25, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0792-01 - Red Hat JBoss Enterprise Web Platform is a platform for Java applications, which integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam. It was found that the org.jboss.seam.web.AuthenticationFilter class implementation did not properly use Seam logging. A remote attacker could send specially crafted authentication headers to an application, which could result in arbitrary code execution with the privileges of the user running that application. The CVE-2014-0248 issue was discovered by Marek Schmidt of Red Hat.

tags | advisory, java, remote, web, arbitrary, code execution
systems | linux, redhat
advisories | CVE-2014-0248
MD5 | 6af4c17ba69f75ea939136684d4dc52b
Page 1 of 2
Back12Next

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    2 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close