Rapid PHP Editor IDE version 14.1 suffers from a cross site request forgery vulnerability that can result in remote code execution.
6ee0d5202fb29796edbb6a1380e3dd34bd93375481ef39f7911a9b77db867d09Sophos Web Appliance version 4.2.1.3 suffers from a remote code execution vulnerability.
63701a9eb15e305ac51389eaeadb3b1a48ad8b7a79c8e2be9b6f3fa830db7304Sophos Web Appliance version 4.2.1.3 suffers from a privilege escalation vulnerability. An unprivileged user can obtain an MD5 hash of the administrator password which can then be used to discover the plain-text password.
6c3a7db5cb2b8006c493d363dd8ec25ba892a528fb9c8d8faf875f49faee60aaRed Hat Security Advisory 2016-2600-02 - Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. The following packages have been upgraded to a newer upstream version: squid. Security Fix: Incorrect boundary checks were found in the way squid handled headers in HTTP responses, which could lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response.
5857220b4f3365cf00860fe5f394f9ca6eb5325478cdc5ace61d975e958a56fdRed Hat Security Advisory 2016-2589-02 - The GIMP is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. The following packages have been upgraded to a newer upstream version: gimp, gimp-help. Security Fix: Multiple use-after-free vulnerabilities were found in GIMP in the channel and layer properties parsing process when loading XCF files. An attacker could create a specially crafted XCF file which could cause GIMP to crash.
e7ccfcef1463062e604b45a00d164be00a3f9c8c18fce7320fdc48f7ef4fa887Red Hat Security Advisory 2016-2588-02 - OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix: It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running the login program. In configurations with UseLogin=yes and the pam_env PAM module configured to read user environment settings, a local user could use this flaw to execute arbitrary code as root.
e42f57140a7efe5fbed26ea299866c70053ee97e49db3eaf4d90707a4f1db249Ubuntu Security Notice 3121-1 - It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy function in certain cases. An attacker could use this to bypass Java sandbox restrictions. It was discovered that OpenJDK did not restrict the set of algorithms used for Jar integrity verification. An attacker could use this to modify without detection the content of a JAR file, affecting system integrity. Various other issues were also addressed.
6e2c2611e69dcfc1af24a871346396be4d71f6ceb1d5e3a9281cd987d582fd41Red Hat Security Advisory 2016-2657-01 - Red Hat JBoss Enterprise Application Platform 7 is an application server that serves as a middleware platform and is built on open standards and compliant with the Java EE 7 specification. This release serves as an update for Red Hat JBoss Enterprise Application Platform 7.0.2. It includes bug fixes and enhancements.
2ac1a278f912730b32787ec1f3378650af12426a52efed5e0f5706b6904cb90dGentoo Linux Security Advisory 201611-4 - Multiple vulnerabilities have been found in Oracle's JRE and JDK software suites allowing remote attackers to remotely execute arbitrary code, obtain information, and cause Denial of Service. Versions less than 1.8.0.111 are affected.
02cc3c1f0dff6bbbea1d2daff6bbb65c7ec0e950ea37ca62bb3470a40d8eeffdGentoo Linux Security Advisory 201611-3 - Multiple vulnerabilities have been found in both LibreOffice and OpenOffice, the worst of which allows for the remote execution of arbitrary code. Versions less than 5.1.4.2 are affected.
d4f62ade266048e5526b64cf31754ee6ae9fa798f8bf706136f9888c4b219ff5HPE Security Bulletin HPSBUX03664 SSRT110248 1 - Potential security vulnerabilities have been identified in the HP-UX BIND service running named. These vulnerabilities could be exploited remotely to create a Denial of Service (DoS). Revision 1 of this advisory.
8392ef8f305c64e4593fbb2199e3103ae32dcd3a29294e47dec33379b147a07aRed Hat Security Advisory 2016-2634-01 - Docker is an open-source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that will run virtually anywhere. Security Fix: It was found that Docker would launch containers under the specified UID instead of a username. An attacker able to launch a container could use this flaw to escalate their privileges to root within the launched container.
3f4759834add8ea916eed7fbb166d284f95a5b4703ac8f04175efad7653b3a85Cisco Security Advisory - A vulnerability in Cisco Meeting Server and Meeting App could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. The vulnerability exists because the software does not perform sufficient boundary checks on user-supplied data. An unauthenticated, remote attacker could exploit this vulnerability by sending crafted IPv6 input to the vulnerable function. A successful exploit could result in an exploitable buffer underflow condition. An attacker could leverage this buffer underflow condition to incorrectly allocate memory and cause a reload of the device or execute arbitrary code with the privileges of the affected application. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available.
0dc16e3997cc5709f18ca8b554b69f0dc218df3ac3988b7a807e4c7d79edf309Red Hat Security Advisory 2016-2641-01 - Red Hat JBoss Enterprise Application Platform 7 is an application server that serves as a middleware platform and is built on open standards and compliant with the Java EE 7 specification. This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.0.2. It includes bug fixes and enhancements.
3a7a88c14b23fb1b7c1e64e43085328f4cc985ab7c84d810f7ae51bbc271e942Red Hat Security Advisory 2016-2642-01 - The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services Elastic Compute Cloud. With this update, the eap7-jboss-ec2-eap package has been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 7.0.3.
eac40a169ecbee4d645a8948d84e2d9d7230d72d1ec3d859161e2d1d59a7b064Red Hat Security Advisory 2016-2640-01 - Red Hat JBoss Enterprise Application Platform 7 is an application server that serves as a middleware platform and is built on open standards and compliant with the Java EE 7 specification. This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.0.2. It includes bug fixes and enhancements.
798a797dfb4574248194f130ac60bff0e56eacce1a7786dce1134c92892f57e0Ubuntu Security Notice 3123-1 - It was discovered that curl incorrectly reused client certificates when built with NSS. A remote attacker could possibly use this issue to hijack the authentication of a TLS connection. Nguyen Vu Hoang discovered that curl incorrectly handled escaping certain strings. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. Various other issues were also addressed.
9a583cd9fd7d0779073b4a1732e533632181d0c8e3450d97b2e4e7952b834f9cRed Hat Security Advisory 2016-2610-01 - The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
49740239f4a9db4384de9e52d9d88f513feee6fd4dd0b96fb355f18362ecb1a2Ubuntu Security Notice 3122-1 - It was discovered that the NVIDIA graphics drivers incorrectly sanitized user mode inputs. A local attacker could use this issue to possibly gain root privileges.
7d1c65ce9253e83851368f2289921106e60d6cd0c7580a63fb29df2bd593194fRed Hat Security Advisory 2016-2615-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. Security Fix: A denial of service flaw was found in the way BIND handled responses containing a DNAME answer. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response.
f6194b8a597dfb68e712304f606ee5d757bbcceab3ac78c54ea68c6f155b9ca6Red Hat Security Advisory 2016-2614-01 - The Pacemaker cluster resource manager is a collection of technologies working together to provide data integrity and the ability to maintain application availability in the event of a failure. Security Fix: An authorization flaw was found in Pacemaker, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.
112d3c70c6c5a82de133d4ce3509279e69312048a60568fffcb0aa043aa2c9e4Cisco Security Advisory - A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated, remote attacker to cause a reload of, or remotely execute code on, the affected system. The vulnerability exists because the affected software performs incomplete bounds checks on input data. An attacker could exploit this vulnerability by sending a malicious request to the TL1 port, which could cause the device to reload. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or cause a reload of the affected system. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
ced8dc5d0190e0c2046e7b4711ec7054742dc439b5bb859ea3d02f3ba9a9a804Red Hat Security Advisory 2016-2606-02 - PostgreSQL is an advanced object-relational database management system. The following packages have been upgraded to a newer upstream version: postgresql. Security Fix: A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code.
c99a6f532bfabc4533d530b609b0c740b77fe5e55545d92a489c34090bde5b63Red Hat Security Advisory 2016-2603-02 - Libreswan is an implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network. Security Fix: A traffic amplification flaw was found in the Internet Key Exchange version 1 protocol. A remote attacker could use a libreswan server with IKEv1 enabled in a network traffic amplification denial of service attack against other hosts on the network by sending UDP packets with a spoofed source address to that server.
05b3b2e28657d631cce895e8b1e65bc1175b969ca8f48872019bea4b4749f5b9Red Hat Security Advisory 2016-2599-02 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. The following packages have been upgraded to a newer upstream version: tomcat. Security Fix: A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.
eb4b78c2f1daa3013b5a8463412acf3f72bbf7cecd1cb000754357f150091883
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed