In the "Shutter" screenshot application, I discovered that using the "Show in folder" menu option while viewing a’à † † ƒQ€ƒO †œ1 ƒOty">
Vulnerability Summary: All Logstash versions prior to 1.5.2 that use Lumberjack input (in combination with Logstash Forwarder agent) are vulnerable to a SSL/TLS security issue called the FREAK attack. This allows an attacker to intercept communication and access secure data. Users should upgrade to 1.5.3 or 1.4.4.
Remediation Summary: Users that do not want to upgrade can address the vulnerability by disabling the™€ † † ‚_€‚& _„à· t—n †›Pa‚] files read and executed by certain other applications.
Remediation Summary: Users should upgrade to 1.6.0. Alternately,
ensure that other applications are not present on the system, or
that Elasticsearch cannot write into areas where these applications
would read4165
SECURITY-76 & SECURITY-88 / CVE-2013-5573
Restrictions of HTML tags for user-editable contents are too
lax. This allows malicious users of Jenkins to¾À † † ‚p
† aÍ@€‚h †œ1 ‚nediate1443
XML attacks
Django's serialization framework was vulnerable to attacks via XML
entity expansion and external references; this is now fixed.
However, if you're parsing arbitrary XML in other parts of your
application, we recommend you look into the defusedxml Python
packages which remedy this anywhere you parse XML, not just via
Ñ † † ‚0• v‚ž@€‚ ^ƒµ †›~3‚.0614
A buffer overflow is causing a crash or freeze of WeeChat when decoding IRC colors in strings.
Workaround for a non-patched version: /set irc.network.colors_receive off×À † † ƒQ€ƒO †œ1 ƒOll be given default permissions (scp) to the entire system, potentially circumventing any configured chroot. Fixing this required a behavior change: in the past, using rssh without a config file would give all users default access to use scp on an unchrooted system. In order to correct the reported bug, this feature has been eliminated, and you must now have a valid configuration file. If no config file exists, all users will be locÝà † † ƒQ€ƒO †œ1 ƒO
When a new user registers, the new user can add arbitrary HTML and script code into the user topic which is generated by the RegistrationAgent via standard registration fields such as "FirstName" or "OrganisationName".
By design, Foswiki's normal editing features allow arbitrary HTML markup, including script code, to be inserted into any topic anyway, assuming the authenticated user has CHANGE permission - which ä€ † † ƒQ€ƒO †œ1 ƒOp>[108416] Medium CVE-2011-3960: Out-of-bounds read in audio decoding. Credit to Aki Helin of OUSPG.
[108871] Critical CVE-2011-3961: Race condition after crash of utility process. Credit to Shawn Goertzen.
[108901] Medium CVE-2011-3962: Out-of-bounds read in path clipping. Credit to Aki Helin of OUSPG.
[109094] Medium CVE-2011-3963: Out-of-bounds read in PDF fax image handling. Credit to Atte Kettunen of Oê † † ‚!€ ^…À R†sˆ †œ1 ‚ execute arbitrary code via vectors related to (1) NAME, (2) PLYR, (3) CHTS, or (4) AIPL (aka AI config) chunk loading from a savegame.3342
http://security.openttd.org/en/CVE-2011-3342 2011-08-08e77befb5ðÀ † † ‚u€f \Ü>€‚ †œ1 ‚s During this audit, several vulnerabilities were found which affect earlier releases of RT.1-1685 CVE-2011-1686 CVE-2011-1687 CVE-2011-1688 CVE-2011-1689 CVE-2011-1690 http://secunia.com/advisories/44189 öà † † ƒ › F‚ƒ~€‚n †œ1 ƒ ts:Fixed in 15.0.874.121:
[103259] High CVE-2011-3900: Out-of-bounds write in v8. Credit to Christian Holler.Fixed in 15.0.874.120:
[100465] High CVE-2011-3892: Double free in Theora decoder. Credit to Aki Helin of OUSPG.
[100492] [100543] Medium CVE-2011-3893: Out of bounds reads in MKV and Vorbý€ † † ‚l€T _„° €‚ Mƒï@ †›jG‚jthe larger value of the "frame_freq" setting is easier it is to trigger the bug2534http://security.openttd.org/en/CVE-2010-2534 2010-06-27 2010-08-22 corkscrew --ƒ † † ƒQ€ƒO †œ1 ƒO0fc4d8"> apache -- Prevent chunk-size integer overflow on platforms where sizeof(int) < sizeof(long) apache 1.3.42 apache+mod_perl 1.3.42 apache+ipv6 1.3.42 apache_fp 0<‰À † † ‚X€y y‚É@€] †œ1 ‚Vects> squid 3.0.1 3.0.17 3.1.0.1 3.1.0Squid security advisory 2009:2 reports: Due to incorrect buffer limits and related bound checks Squid is vulnerable to a denial ofà † † ‚Y €‚W z«= †œ/‚W9-02-04
2009-02-11 2009-12-12 codeigniter -- arbitrary script execution in the new Form Validation class codeigniter 1.7.0 1–€ † † ‚}€X T‰9€# †œ1 ‚{.igniterealtime.org/builds/openfire/docs/latest/changelog.html http://secunia.com/Advisories/32478/ 2008-11-07 2008-11-1975f2382e-b586-11dd-95f9-00e0815b8da8"> syslog-ng2 -- startup directory leakage in the chroot environment syœ † † ‚[Ÿ v‚ó?€‚: †œ1 ‚Ymail 6.3.8_6Matthias Andree reports: Gunter Nau reported fetchmail crashing on some messages; further debugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic dug up that this happened when fetchmail was trying to print, in¢À † † ‚y€0 X¡?€G †œ1 ‚w advisory.
An error in the PP implementation within the "dn_expand()" function can be exploited to cause a stack overflow due to an endless loop via a specially crafted DNS pa¯€ † † ƒ €P G‚¼@€8 †œ1 ƒlified Domain Name) returned is excessively long, the allocated buffer is overflowed making it possible to execute arbitrary code on the system with the privileges of the sircd daemon.
bid>6924An unspecified error can be exploited to gain knowledge
of the MySQL password4069
A vulnerability has been reported, which can be exploited by malicious people to conduct script insertion attacks.
Input passed using the wiki macro isn't properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in Áà † † ‚v [ù €‚t †œ1 ‚tMitre CVE reports: