The International Conference on Semantic Web Business and Innovation (SWBI2015) has announced it’s call for participation. It will be held at the University of Applied Sciences and Arts Western Switzerland October 7th through the 9th, 2015.
Monthly Archives: September 2014
Ubuntu Security Notice USN-2330-1
Ubuntu Security Notice 2330-1 – Jan de Mooij, Christian Holler, Karl Tomlinson, Randell Jesup, Gary Kwong, Jesse Ruderman and JW Wang discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. Abhishek Arya discovered a use-after-free during DOM interactions with SVG. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. Various other issues were also addressed.
Red Hat Security Advisory 2014-1184-01
Red Hat Security Advisory 2014-1184-01 – Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and remote management of multiple Linux deployments with a single, centralized tool. The spacewalk-java packages contain the code for the Java version of the Spacewalk Web site. A stored cross-site scripting flaw was found in the way spacewalk-java displayed log files. By sending a specially crafted request to Satellite, a remote attacker could embed HTML content into the log file, allowing them to inject malicious content into the web page that is used to view that log file.
Red Hat Security Advisory 2014-1186-01
Red Hat Security Advisory 2014-1186-01 – The katello-configure package provides the katello-configure script, which configures the Katello installation, and the katello-upgrade script, which handles upgrades between versions. It was discovered that the default configuration of Elasticsearch enabled dynamic scripting, allowing a remote attacker to execute arbitrary MVEL expressions and Java code via the source parameter passed to _search. All Subscription Asset Manager users are advised to upgrade to this updated package. The update provides a script that modifies the elasticsearch.yml configuration file to disable dynamic scripting. After updating, run the “katello-configure” command. This will update the elasticsearch.yml configuration file and restart the elasticsearch service.
VMware Security Advisory 2014-0009
VMware Security Advisory 2014-0009 – VMware NSX and vCloud Networking and Security (vCNS) product updates address a vulnerability that could lead to critical information disclosure.
NEW VMSA-2014-0009 VMware NSX and vCNS product updates address a critical information disclosure vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2014-0009
Synopsis: VMware NSX and vCNS product updates address a critical
information disclosure vulnerability
Issue date: 2014-09-11
Updated on: 2014-09-11 (Initial Advisory)
CVE number: CVE-2014-3796
- ------------------------------------------------------------------------
1. Summary
VMware NSX and vCloud Networking and Security (vCNS) product updates
address a vulnerability that could lead to critical information
disclosure.
2. Relevant releases
NSX 6.0 prior to 6.0.6
vCNS 5.5 prior to 5.5.3
vCNS 5.1.4 prior to 5.1.4.2
3. Problem Description
a. VMware NSX and vCNS information disclosure vulnerability
VMware NSX and vCNS contain an input validation vulnerability.
This issue may allow for critical information disclosure.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2014-3796 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware ProductRunning Replace with/
Product Versionon Apply Patch
============= ============== =================
NSX Edge 6.1 any not affected
NSX Edge 6.0 any 6.0.6
vCNS Edge 5.5 any 5.5.3
vCNS Edge 5.1 any 5.1.4.2
4. Solution
Please review the patch/release notes for your product and version
and verify the checksum of your downloaded file.
VMware NSX
----------
Downloads:
https://www.vmware.com/go/download-nsx-vsphere
Documentation:
https://www.vmware.com/support/pubs/nsx_pubs.html
vCNS
----
Downloads:
https://www.vmware.com/go/download-vcd-ns
Documentation:
https://www.vmware.com/support/pubs/vshield_pubs.html
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3796
- ------------------------------------------------------------------------
6. Change log
2014-09-11 VMSA-2014-0009
Initial security advisory in conjunction with the release of VMware
NSX 6.1 and 6.0.6 and 5.1.4.2 on 2014-09-11. vCNS 5.5.3 was released
on 2014-09-09.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2014 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.0 (Build 8741)
Charset: utf-8
wj8DBQFUEeSmDEcm8Vbi9kMRAvS+AKDNN3ikZZCVNUXMMjr8JhXprLy+OACfSFgC
2sLRyfwcA1eVX5lpJWABXPI=
=F5rV
-----END PGP SIGNATURE-----
NEW VMSA-2014-0009 VMware NSX and vCNS product updates address a critical information disclosure vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2014-0009
Synopsis: VMware NSX and vCNS product updates address a critical
information disclosure vulnerability
Issue date: 2014-09-11
Updated on: 2014-09-11 (Initial Advisory)
CVE number: CVE-2014-3796
- ------------------------------------------------------------------------
1. Summary
VMware NSX and vCloud Networking and Security (vCNS) product updates
address a vulnerability that could lead to critical information
disclosure.
2. Relevant releases
NSX 6.0 prior to 6.0.6
vCNS 5.5 prior to 5.5.3
vCNS 5.1.4 prior to 5.1.4.2
3. Problem Description
a. VMware NSX and vCNS information disclosure vulnerability
VMware NSX and vCNS contain an input validation vulnerability.
This issue may allow for critical information disclosure.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2014-3796 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware ProductRunning Replace with/
Product Versionon Apply Patch
============= ============== =================
NSX Edge 6.1 any not affected
NSX Edge 6.0 any 6.0.6
vCNS Edge 5.5 any 5.5.3
vCNS Edge 5.1 any 5.1.4.2
4. Solution
Please review the patch/release notes for your product and version
and verify the checksum of your downloaded file.
VMware NSX
----------
Downloads:
https://www.vmware.com/go/download-nsx-vsphere
Documentation:
https://www.vmware.com/support/pubs/nsx_pubs.html
vCNS
----
Downloads:
https://www.vmware.com/go/download-vcd-ns
Documentation:
https://www.vmware.com/support/pubs/vshield_pubs.html
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3796
- ------------------------------------------------------------------------
6. Change log
2014-09-11 VMSA-2014-0009
Initial security advisory in conjunction with the release of VMware
NSX 6.1 and 6.0.6 and 5.1.4.2 on 2014-09-11. vCNS 5.5.3 was released
on 2014-09-09.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2014 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.0 (Build 8741)
Charset: utf-8
wj8DBQFUEeSmDEcm8Vbi9kMRAvS+AKDNN3ikZZCVNUXMMjr8JhXprLy+OACfSFgC
2sLRyfwcA1eVX5lpJWABXPI=
=F5rV
-----END PGP SIGNATURE-----