Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers.
02ddbcf9b10f9dfa1e36eec00fe00cb5b5ce8e07203843baf056ac7909911fcdUbuntu Security Notice 3407-1 - It was discovered that a vulnerability in PyJWT doesn't check invalid_strings properly for some public keys. A remote attacker could take advantage of a key confusion to craft JWTs from scratch.
e3e01befa15d7f06ef941139b36fa41772cafde88db23d227c8322291d44e7efThis Metasploit module exploits CVE-2017-1000117, which affects Git versions 2.7.5 and lower. A submodule of the form 'ssh://' can be passed parameters from the username incorrectly. This can be used to inject commands to the operating system when the submodule is cloned. This Metasploit module creates a fake git repository which contains a submodule containing the vulnerability. The vulnerability is triggered when the submodules are initialized.
c48c626489d0816c8550fa1832a7c70cc94f774c3664902dd69f730db0e3d3e7It was discovered that the Linux kernel did not honor the UEFI secure boot mode when performing a kexec operation. A local attacker could use this to bypass secure boot restrictions. Huang Weller discovered that the ext4 filesystem implementation in the Linux kernel mishandled a needs-flushing-before-commit list. A local attacker could use this to expose sensitive information.
c7df1f4aa0c771c693ab5cdc029c2592e8150b9b8545e98b1a33e436c816e1b2Red Hat Security Advisory 2017-2560-01 - Red Hat Certificate System is a complete implementation of an enterprise software system designed to manage enterprise public key infrastructure deployments. Security Fix: An input validation error was found in Red Hat Certificate System's handling of client provided certificates. If the certreq field is not present in a certificate an assertion error is triggered causing a denial of service.
2d5e6910c074eef9529b80d25596e174c146febd35f90ff2325b0df303b172c6Red Hat Security Advisory 2017-2550-01 - Poppler is a Portable Document Format rendering library, used by applications such as Evince. Security Fix: An integer overflow leading to heap-based buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler to crash, or potentially execute arbitrary code when opened.
30fdfed1c4eb00dafa9a5feb388b038bd737ddb981a4bf137483e157cd0b076cRed Hat Security Advisory 2017-2551-01 - Poppler is a Portable Document Format rendering library, used by applications such as Evince. Security Fix: A stack-based buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler to crash, or potentially execute arbitrary code when opened. An integer overflow leading to heap-based buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler to crash, or potentially execute arbitrary code when opened.
40c08e6162faea24c09e05a6cf44985ab8e36c79bc0204d551d2415ef949d805Red Hat Security Advisory 2017-2553-01 - Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic. Security Fix: An unsigned int wrap around leading to a buffer over-read was found when parsing OFPT_QUEUE_GET_CONFIG_REPLY messages in Open vSwitch. An attacker could use this flaw to cause a remote DoS. In Open vSwitch, while parsing an OpenFlow role status message there is a call to the abort() function for undefined role status reasons in the function `ofp_print_role_status_message` in `lib/ofp-print.c` that may be leveraged toward a remote DoS attack by a malicious switch.
56936320101a5b922f34ab434526419eab4c9e3ba19796ee3ceb3cb4ad530d0eRed Hat Security Advisory 2017-2557-01 - instack-undercloud provides a collection of scripts and elements that can be used to install an OpenStack undercloud. Security Fix: A flaw was found in instack-undercloud where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files. This issue was discovered by Matthew Booth .
d8d742bba2be07ffe66985713f1cfdc96b7b75bf4fe441ffceeacbea010127a4
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed