[SECURITY] [DSA 3250-1] wordpress security update
Monthly Archives: May 2015
Mozilla To Whack HTTP Sites With Feature-Ban Stick
WordPress Ultimate Product Catalogue 3.1.2 XSS / CSRF / File Upload
WordPress Ultimate Product Catalogue plugin version 3.1.2 suffers from cross site request forgery, cross site scripting, and file upload vulnerabilities.
Apache Xerces-C XML Parser Denial Of Service
Apache Xerces-C XML Parser versions prior to 3.1.2 denial of service proof of concept exploit.
DSA-3251 dnsmasq – security update
Nick Sampanis discovered that dnsmasq, a small caching DNS proxy and
DHCP/TFTP server, did not properly check the return value of the
setup_reply() function called during a TCP connection, which is used
then as a size argument in a function which writes data on the client’s
connection. A remote attacker could exploit this issue via a specially
crafted DNS request to cause dnsmasq to crash, or potentially to obtain
sensitive information from process memory.
MDVA-2015:010: timezone
This is a maintenance and bugfix release that upgrades the timezone
data packages and the php-timezonedb packages to the 2015d version.
MDVSA-2015:226: fcgi
Updated fcgi packages fix security vulnerability:
FCGI does not perform range checks for file descriptors before use of
the FD_SET macro. This FD_SET macro could allow for more than 1024
total file descriptors to be monitored in the closing state. This
may allow remote attackers to cause a denial of service (stack memory
corruption, and infinite loop or daemon crash) by opening many socket
connections to the host and crashing the service (CVE-2012-6687).
MDVSA-2015:225: cherokee
Updated cherokee packages fix security vulnerability:
The cherokee_validator_ldap_check function in validator_ldap.c in
Cherokee 1.2.103 and earlier, when LDAP is used, does not properly
consider unauthenticated-bind semantics, which allows remote attackers
to bypass authentication via an empty password (CVE-2014-4668).
MDVSA-2015:224: ruby
Updated ruby packages fix security vulnerability:
Ruby OpenSSL hostname matching implementation violates RFC 6125
(CVE-2015-1855).
The ruby packages for MBS2 has been updated to version 2.0.0-p645,
which fixes this issue.
MDVSA-2015:223: directfb
Updated directfb packages fix security vulnerabilities:
Multiple integer signedness errors in the Dispatch_Write function
in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB allow
remote attackers to cause a denial of service (crash) and possibly
execute arbitrary code via the Voodoo interface, which triggers a
stack-based buffer overflow (CVE-2014-2977).
The Dispatch_Write function in
proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB allows
remote attackers to cause a denial of service (crash) and possibly
execute arbitrary code via the Voodoo interface, which triggers an
out-of-bounds write (CVE-2014-2978).