Alexander Cherepanov discovered that bsdcpio, an implementation of the
cpio
program part of the libarchive project, is susceptible to a
directory traversal vulnerability via absolute paths.
Monthly Archives: March 2015
CVE-2015-2209
DLGuard 4.5 allows remote attackers to obtain the installation path via the c parameter to index.php.
Avast Battery Saver extends your Android’s battery life
New intelligent app from Avast learns individual user behavior and optimizes features to maximize battery life.
Get Avast Battery Saver for free from Google Play
Avast is excited to announce the release of our newest app, Avast Battery Saver. Battery Saver is the first intelligent battery-saver app for Android that increases battery life by an average of 7 hours. Avast Battery Saver optimizes your device’s settings, adjusting data connections, screen brightness and timeouts based off of its ability to learn about individual usage behavior.
“Everyone needs more battery life for their mobile devices, but most battery savers shut down the wrong apps,” said Jude McColgan, Avast’s President of Mobile. “Avast Battery Saver learns which apps are most important to the user, and shuts down only those that are less used.”
In contrast to other battery-saver applications, Avast Battery Saver learns about your daily routine and thus suggests the best smart profiles for your phone. It doesn’t require you to change your behavior or usage, nor does it affect voice calls, text messages, or the ring volume of your phone.
Avast Battery Saver significantly improves battery life, saving up to 20% on one charge — and it’s free from the Google Play Store.
This improved battery manager will take care of your battery’s health the same way a doctor takes care of yours. The result is more battery life with less hassle.
The app’s convenient features make Android devices significantly more efficient
- Smart profiles activate automatically based on time, location, and battery level.
- App consumption detects and permanently stops apps that drain too much battery life.
- Precise estimate of remaining battery life based on actual phone usage and historical data. Battery level is displayed in a percentage and time remaining in status bar notification.
- The application can turn off Wi-Fi when there are no known hotspots nearby.
- Your phone limits connections to the Internet to every 5, 10, 15 or 30 minutes, based on your current profile configuration, when its screen is turned off.
- Emergency mode is activated when your battery level is very low, and it turns off all functions that require significant energy, saving power for when you really need it (e.g. Wi-Fi, data connection, Bluetooth or GPS).
The app currently works with these profiles: Home, Work, Night, and Super-Saving Emergency Mode. You can easily switch from one mode to another and manage them within the app. Avast Battery Saver is now available for download in the Google Play Store.
Fedora 22 Security Update: jBCrypt-0.4-1.fc22
Fedora 22 Security Update: libmspack-0.5-0.1.alpha.fc22
Resolved Bugs
1196154 – libmspack: various flaws [fedora-all]
1196153 – libmspack: off-by-one(?) buffer under-read in mspack/lzxd.c
1196157 – libmspack: off-by-one buffer over-read in mspack/mszipd.c
1180177 – libmspack: pointer arithmetic overflow during CHM decompression
1180180 – libmspack: pointer arithmetic overflow during CHM decompression [fedora-all]
1180175 – libmspack: denial of service while processing crafted CHM file (floating point exception)
1180178 – libmspack: denial of service while processing crafted CHM file (floating point exception) [fedora-all]
1178867 – CVE-2014-9556 libmspack: buffer overflow causing denial of service in qtmd_decompress()
1179822 – CVE-2014-9556 libmspack: buffer overflow causing denial of service in qtmd_decompress() [fedora-all]<br
updated to bugfix release 0.5alpha
Fedora 22 Security Update: putty-0.64-1.fc22
Fedora 22 Security Update: tcllib-1.16-5.fc22
Fedora 22 Security Update: dokuwiki-0-0.24.20140929c.fc22
Resolved Bugs
1197822 – CVE-2015-2172 dokuwiki: privilege escalation in RPC API
1064524 – Wrong SELinux type in dokuwiki-selinux package
1150134 – dokuwiki: various security flaws [epel-all]
1174333 – CVE-2014-9253 dokuwiki: XSS via SFW file upload [epel-6]
1061477 – wiki:syntax page requires php-xml to render
1150133 – dokuwiki: various security flaws [fedora-all]
1174331 – CVE-2014-9253 dokuwiki: XSS via SFW file upload [fedora-all]
1161816 – dokuwiki is 5 months out of date, 2 versions and 3 hotfixes behind
1174332 – CVE-2014-9253 dokuwiki: XSS via SFW file upload [epel-5]
1101095 – New release available – 2014-05-05 “Ponder Stibbons”
1164396 – dokuwiki requires apache
1166099 – CVE-2012-6662 dokuwiki: jquery-ui: XSS vulnerability in default content in Tooltip widget [fedora-all]
1164394 – Add dokuwiki to epel7<br
This update fixes CVE-2015-2172
* There’s a security hole in the ACL plugins remote API component. The plugin failes to check for superuser permissions before executing ACL addition or deletion. This means everybody with permissions to call the XMLRPC API also has permissions to set up their own ACL rules and thus circumventing any existing rules.
Update to the 2014-09-29b release which contains various fixes, notably:
Security:
* CVE-2014-9253 – XSS via SFW file upload
* CVE-2012-6662 – jquery-ui XSS vulnerability
Bugfixes:
* dokuwiki requires php-xml (RHBZ#1061477)
* wrong SELinux file context for writable files/directories (RHBZ#1064524)
* drop httpd requirement (RHBZ#1164396)
Update to the 2014-09-29b release which contains various fixes, notably:
Security:
* CVE-2014-9253 – XSS via SFW file upload
* CVE-2012-6662 – jquery-ui XSS vulnerability
Bugfixes:
* dokuwiki requires php-xml (RHBZ#1061477)
* wrong SELinux file context for writable files/directories (RHBZ#1064524)
* drop httpd requirement (RHBZ#1164396)
Update to the 2014-09-29b release which contains various fixes, notably:
Security:
* CVE-2014-9253 – XSS via SFW file upload
* CVE-2012-6662 – jquery-ui XSS vulnerability
Bugfixes:
* dokuwiki requires php-xml (RHBZ#1061477)
* wrong SELinux file context for writable files/directories (RHBZ#1064524)
* drop httpd requirement (RHBZ#1164396)
Update to the 2014-09-29b release which contains various fixes, notably:
Security:
* CVE-2014-9253 – XSS via SFW file upload
* CVE-2012-6662 – jquery-ui XSS vulnerability
Bugfixes:
* dokuwiki requires php-xml (RHBZ#1061477)
* wrong SELinux file context for writable files/directories (RHBZ#1064524)
* drop httpd requirement (RHBZ#1164396)
This update adds dokuwiki package to EPEL7
CVE-2014-8617
Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMail before 4.3.9, 5.0.x before 5.0.8, 5.1.x before 5.1.5, and 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via the release parameter to module/releasecontrol.
Debian Security Advisory 3179-1
Debian Linux Security Advisory 3179-1 – Multiple security issues have been found in Icedove, Debian’s version of errors and implementation errors may lead to the execution of arbitrary code or information disclosure.