Resolved Bugs
684294 – CVE-2010-3609 openslp: denial of service vulnerability
721103 – CVE-2010-3609 openslp: denial of service vulnerability [epel-5]<br
openslp: denial of service vulnerability (CVE-2010-3609)
Monthly Archives: May 2015
Fedora EPEL 5 Security Update: t1utils-1.39-1.el5
Resolved Bugs
1218365 – t1utils: buffer overflow flaw
1218367 – t1utils: buffer overflow flaw [epel-all]<br
t1utils Version 1.39 (2015-02-26)
=================================
* t1disasm: Security fixes for buffer overrun reported by Jakub Wilk and Niels Thykier.
t1utils Version 1.38 (2013-09-29)
=================================
* t1disasm: Fix an infinite loop on some fonts reported by Niels Thykier.
Google Research Reveals Profitable, Pervasive Ad Injector Ecosystem
More than five percent of all unique IP addresses accessing Google sites included some kind of ad injector software, and there are more than 50,000 of those injector browser extensions in use today, according to new research from Google.
Rombertik: the malware that destroys computers if detected
Researchers have uncovered a new malware which will try to ‘destroy’ the computer if it suspects it is being analyzed, reports First Post.
The post Rombertik: the malware that destroys computers if detected appeared first on We Live Security.
WordPress eShop 6.3.11 Code Execution
High-Tech Bridge Security Research Lab discovered a security vulnerability in the eShop WordPress Plugin, which can be exploited by remote attackers to overwrite arbitrary PHP variables within the context of the vulnerable application. The vulnerability exists due to insufficient validation of user-supplied input in the “eshopcart” HTTP cookie. Successful exploitation of this vulnerability may potentially result in arbitrary PHP code execution.
F5 BIG-IP ASM 11.4.1 Filter Bypass
The F5 ASM is a web application firewall designed to protect web applications from attacks. Due to the way that the system processes JSON content, it’s possible to bypass the ASM using a crafted request to a URL that processes both JSON and regular URL encoded requests. Versions 11.4.0 and 11.4.1 are confirmed vulnerable.
No iOS Zone, the vulnerability that enables DoS attacks on Apple devices
Two researchers surprised people by demonstrating how they could carry out a denial of service (DoS) attack on iOS devices.
The post No iOS Zone, the vulnerability that enables DoS attacks on Apple devices appeared first on We Live Security.
BIG-IQ 0.0.7028 Information Disclosure
BIG-IQ version 0.0.7028 appears to disclose user passwords that are encrypted via an insecure direct object reference vulnerability and allows for user enumeration.
Ubuntu Security Notice USN-2597-1
Ubuntu Security Notice 2597-1 – A race condition between chown() and execve() was discovered in the Linux kernel. A local attacker could exploit this race by using chown on a setuid-user-binary to gain administrative privileges.
Red Hat Security Advisory 2015-0938-01
Red Hat Security Advisory 2015-0938-01 – OpenStack Image Service provides discovery, registration, and delivery services for disk and server images. It provides the ability to copy or snapshot a server image, and immediately store it away. Stored images can be used as a template to get new servers up and running quickly and more consistently than installing a server operating system and individually configuring additional services. Multiple flaws were found in the glance task API that could cause untracked image data to be left in the back end. A malicious user could use these flaws to deliberately accumulate untracked image data, and cause a denial of service via resource exhaustion.