Incomplete WPS and P2P NFC NDEF record payload length
validation. (2015-5)8041
«à † † ƒ!€n Oƒý?€‚1 †œ ƒ possible on Cygwin to get around cabextract's
absolute and relative path protections by using backslasheurl>http://www.cabextract.org.uk/#changes
http://www.openwall.com/lists/oss-security/2015/02/18/3
CVE-2015-2060
2015-02-18
2015-05-31
In accordance with our security release policy, the Django team
is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and
1.8c1. These releases are now available on PyPI and our download
page. These releases address several security issues detailed
below. We encourage all users of Django to upgrade as soon as
possible. The Django master branch has also been updated¸ † † ‚Z€m L†€y€k g†‚0 †›u ‚Xes>
subversion -- DoS vulnerabilities
mod_dav_svn
1.8.01.8.11
subversion17
1.0.01.7.19¾À † † ƒp€ƒn †œ ƒntxt">
A flaw in OBJ_obj2txt may cause pretty printing functions
such as X509_name_oneline, X509_name_print_ex et al. to leak
some information from the stack. [CVE-2014-3508]
The issue affects OpenSSL clients and allows a malicious
server to crash the client with a null pointer dereference
(read) by specifying an SRP ciphersuite even though it was
not properly negotiated with the client. [CVE-2014-5139]
If a multithreaded client connects toÄà † † ƒ5 €ƒ3 g5 †›f,ƒ3nginx.org/pipermail/nginx-announce/2014/000135.html
2014-03-18
2014-03-23
apache -- several vulnerabilities
apache24
2.4.02.4.9
apache22Ë€ † † ƒ*€ FƒÛ@€) †œ ƒ( Fratric of the Google Security Team discovered a bug in nginx, which might
allow an attacker to bypass security restrictions in certain configurations by
using a specially crafted request, or might have potential other impact
(CVE-2013-4547). CVE-2013-4547
http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html
11.017.0.7iscellaneous memory safety hazards (rv:22.0 / rv:17.0.7)
Title: Memory corruption found using Address Sanitizer
Privileged content access and execution via XBL
Arbitrary code execut×À † † ‚z€) ví>€O †œ ‚x81d254-70c6-11e2-862d-080027a5ec9a">
libexif -- multiple remote vulnerabilities
libexif
0.6.21libexif project security advisory:
A number of remotely exploitable issues were discovered in libexif
and exÝà † † ‚
g…-€‚ †œ ‚2/">
This advisory covers vulnerabilities discovered in the OTRS core
system. This is a variance of the XSS vulnerability, where an attacker could
send a specially prepared HTML email to OTRS which would cause JavaScript code
to be executed in your browser ä€ † † ƒ"€‚$ Nƒˆ€| †œ ƒ uch `eval' forms. Thus, if the user
changes the value of `enable-local-variables' to `:safe',
visiting a malicious file can cause automatic execution of
arbitrary Emacs Lisp code with the permissions of the
user.
The bug is present in Emacs 23.2, 23.3, 23.4, and
24.1bid>54969
CVE-2012-3479
https://lists.gnu.org/archive/html/emacs-devel/2012-08/msgê † †
R ƒ …R€Q †œ Q2.crypt.asc">
There is a programming error in the DES implementation used iðÀ † † ‚r€; C¿€5 Oƒö> †›~‚p/body>
http://downloads.asterisk.org/pub/security/AST-2012-002.html
http://downloads.asterisk.org/pub/security/AST-2012-00315
2012-03-15
OpenSSL -- CMS and S/MIME Bleichenbacher attacköà † † ƒp€ƒn †œ ƒn Team (scarybeasts) and Robert Swiecki of
the Google Security Team.
[102359] High CVE-2011-3912: Use-after-free in SVG filters. Credit
to Arthur Gerkis.
[103921] High CVE-2011-3913: Use-after-free in Range handling.
Credit to Arthur Gerkis.
[104011] High CVE-2011-3914: Out-of-bounds write in v8 i18n
handling. Credit to Slawomir Blazek.
[104529] High CVE-2011-3915: Buffer overflow in PDF font handling.
Credit toý€ † † f€8 O„‹4 i„¡9¬ w…ë@ †›m%ds>
2011-06-08
2011-06-15
linux-flashplugin -- c10-flashplugin
10.3r181.2ƒ † † ƒp€ƒn †œ ƒn-2010-4539">
The walk function in repos.c in the mod_dav_svn module
for the Apache HTTP Server, as distributed in Apache
Subversion before 1.6.15, allows remote authenticated
users to cause a denial of service (NULL pointer
dereference and daemon crash) via vectors that trigger
the walking of SVNParentPath collections.
Entry for CVE-2010-4644 says:
‰À † † ‚i
€‚g …^ †œ‚gn:
When running setuid programs rtld will normally remove potentially
dangerous environment variables. Due to recent changes in FreeBSD
environment variable handling code, a corrupt environment may
result in attempts to unset environment variables failing.