Posted by Roy Nielsen on May 13
STONIX is an operating system configuration hardening tool for Unix and Unix
like (e.g. Linux) operating systems. This tool implements a hybrid of
guidance from NSA, DISA STIGs, USGCB and the CIS. To as great of a degree as
possible each guidance element for each platform is evaluated on the other
platforms for applicability and applied if possible.
Repository at: https://github.com/CSD-Public/stonix
The STONIX program is a modular codebase…
Posted by Anal Bleed on May 13
This is an irresponsible disclosure of the vulnerability, which will bring
large parts of the Internet into its knees – CVE-b045-73d a.k.a Analbleed.
Obviously you can find the fancy logo for it below (officially approved by
the security community and industry worldwide). You can also listen to the
O.S.T. on the vuln’s official website free of charge (as for now) here at
http://analbleed.com. If you are interested in purchasing…
Posted by Onur Yilmaz on May 13
Information
——————–
Advisory by Netsparker.
Name: Multiple XSS Vulnerabilities in Concrete5
Affected Software : Concrete5
Affected Versions: 5.7.3.1 and possibly below
Vendor Homepage : https://www.concrete5.org
Vulnerability Type : Cross-site Scripting
Severity : Important
CVE-ID: CVE-2015-2250
Netsparker Advisory Reference : NS-15-008
Description
——————–
By exploiting a Cross-site scripting vulnerability the attacker…
Red Hat Security Advisory 2015-1001-01 – KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM. An out-of-bounds memory access flaw was found in the way QEMU’s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host’s QEMU process corresponding to the guest.
Red Hat Security Advisory 2015-1005-01 – The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-09 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content.
Red Hat Security Advisory 2015-0999-01 – KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. An out-of-bounds memory access flaw was found in the way QEMU’s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host’s QEMU process corresponding to the guest.
Red Hat Security Advisory 2015-1000-01 – KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM. An out-of-bounds memory access flaw was found in the way QEMU’s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host’s QEMU process corresponding to the guest.
Red Hat Security Advisory 2015-1004-01 – KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM in environments managed by Red Hat Enterprise Linux OpenStack Platform. An out-of-bounds memory access flaw was found in the way QEMU’s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host’s QEMU process corresponding to the guest.
Red Hat Security Advisory 2015-1007-01 – IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.
Red Hat Security Advisory 2015-1006-01 – IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. The CVE-2015-0478 issue was discovered by Florian Weimer of Red Hat Product Security.