HP Security Bulletin HPSBUX03240 SSRT101872 2 – Potential security vulnerabilities have been identified with HP-UX running NTP. These could be exploited remotely to execute code, create a Denial of Service (DoS), or other vulnerabilities. Revision 2 of this advisory.

The Call for Papers for the inaugural Hack In The Box GSEC conference in Singapore is now open. It will be held October 12th through the 16th, 2015 at the Sheraton Towers in Singapore.

Mandriva Linux Security Advisory 2015-198 – Multiple vulnerabilities has been discovered and corrected in java-1.8.0-openjdk. The updated packages provides a solution for these security issues.

Red Hat Security Advisory 2015-0794-01 – Kerberos is a networked authentication system which allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos KDC. The following security issues are fixed with this release: A use-after-free flaw was found in the way the MIT Kerberos libgssapi_krb5 library processed valid context deletion tokens. An attacker able to make an application using the GSS-API library could call the gss_process_context_token() function and use this flaw to crash that application.

Ubuntu Security Notice 2564-1 – An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. An information leak was discovered in the Linux Kernel’s handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. Various other issues were also addressed.

Ubuntu Security Notice 2565-1 – An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. An information leak was discovered in the Linux Kernel’s handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. Various other issues were also addressed.

Cisco Security Advisory – Cisco Adaptive Security Appliance (ASA) Software is affected by command injection, memory exhaustion, and denial of service vulnerabilities.

Ubuntu Security Notice 2561-1 – It was discovered that the Linux kernel’s Infiniband subsystem did not properly sanitize its input parameters while registering memory regions from userspace. A local user could exploit this flaw to cause a denial of service (system crash) or to potentially gain administrative privileges. An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) mitigation mechanism. Various other issues were also addressed.

Ubuntu Security Notice 2562-1 – Sun Baoliang discovered a use after free flaw in the Linux kernel’s SCTP (Stream Control Transmission Protocol) subsystem during INIT collisions. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges on the system. Marcelo Leitner discovered a flaw in the Linux kernel’s routing of packets to too many different dsts/too fast. A remote attacker can exploit this flaw to cause a denial of service (system crash). Various other issues were also addressed.

Ubuntu Security Notice 2560-1 – An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) mitigation mechanism. An information leak was discovered in the Linux kernel’s handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. Various other issues were also addressed.