Cross-site scripting (XSS) vulnerability in the Dashboard in Splunk Enterprise 6.2.x before 6.2.4 and Splunk Light 6.2.x before 6.2.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Monthly Archives: August 2015
CVE-2015-6515
Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.4, 6.1.x before 6.1.8, 6.0.x before 6.0.9, and 5.0.x before 5.0.13 and Splunk Light 6.2.x before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via a header.
CVE-2015-6516
SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via the search parameter to ajax/ajax_search.php.
CESA-2015:1640 Moderate CentOS 6 pam SecurityUpdate
CentOS Errata and Security Advisory 2015:1640 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1640.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 290b2de5b11274bedd3dc14b63bacfc1794b2c4208e4e29979c4c7428eb7964f pam-1.1.1-20.el6_7.1.i686.rpm 6da9c1315ae8d24e44544eed02e3a9fe0c7eece7648bc5b52a3b65a46a86fec8 pam-devel-1.1.1-20.el6_7.1.i686.rpm x86_64: 290b2de5b11274bedd3dc14b63bacfc1794b2c4208e4e29979c4c7428eb7964f pam-1.1.1-20.el6_7.1.i686.rpm 6c9678f3372acbb5f652c2daf83c1f6ecd80b31b79c2b1b61c333c34a179dcdd pam-1.1.1-20.el6_7.1.x86_64.rpm 6da9c1315ae8d24e44544eed02e3a9fe0c7eece7648bc5b52a3b65a46a86fec8 pam-devel-1.1.1-20.el6_7.1.i686.rpm a39aae7c68c958278ba676170b8b8b29429cd74618f2dd1b5a7a6886cfa29458 pam-devel-1.1.1-20.el6_7.1.x86_64.rpm Source: a47936b7aad2c540af234b821224a9ece34577f1f9e6e94974cc91112e850bde pam-1.1.1-20.el6_7.1.src.rpm
Fedora EPEL 5 Security Update: drupal6-views_bulk_operations-1.17-1.el5
Resolved Bugs
1250276 – drupal6-views_bulk_operations-1.17 is available<br
## 6.x-1.17
Fixes #2516976: Fix security issue and make release to bring back D6 releases.
Fedora EPEL 6 Security Update: drupal6-views_bulk_operations-1.17-1.el6
Resolved Bugs
1250276 – drupal6-views_bulk_operations-1.17 is available<br
## 6.x-1.17
Fixes #2516976: Fix security issue and make release to bring back D6 releases.
USN-2711-1: Net-SNMP vulnerabilities
Ubuntu Security Notice USN-2711-1
17th August, 2015
net-snmp vulnerabilities
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary
Net-SNMP could be made to crash or run programs if it received specially
crafted network traffic.
Software description
- net-snmp
– SNMP (Simple Network Management Protocol) server and applications
Details
It was discovered that Net-SNMP incorrectly handled certain trap messages
when the -OQ option was used. A remote attacker could use this issue to
cause Net-SNMP to crash, resulting in a denial of service. (CVE-2014-3565)
Qinghao Tang discovered that Net-SNMP incorrectly handled SNMP PDU parsing
failures. A remote attacker could use this issue to cause Net-SNMP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2015-5621)
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 15.04:
-
libsnmp30
5.7.2~dfsg-8.1ubuntu5.1
- Ubuntu 14.04 LTS:
-
libsnmp30
5.7.2~dfsg-8.1ubuntu3.1
- Ubuntu 12.04 LTS:
-
libsnmp15
5.4.3~dfsg-2.4ubuntu1.3
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
References
USN-2713-1: Linux kernel vulnerabilities
Ubuntu Security Notice USN-2713-1
17th August, 2015
linux vulnerabilities
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 12.04 LTS
Summary
Several security issues were fixed in the kernel.
Software description
- linux
– Linux kernel
Details
Marcelo Ricardo Leitner discovered a race condition in the Linux kernel’s
SCTP address configuration lists when using Address Configuration Change
(ASCONF) options on a socket. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash). (CVE-2015-3212)
A flaw was discovered in how the Linux kernel handles invalid UDP
checksums. A remote attacker could exploit this flaw to cause a denial of
service using a flood of UDP packets with invalid checksums.
(CVE-2015-5364)
A flaw was discovered in how the Linux kernel handles invalid UDP
checksums. A remote attacker can cause a denial of service against
applications that use epoll by injecting a single packet with an invalid
checksum. (CVE-2015-5366)
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 12.04 LTS:
-
linux-image-3.2.0-89-highbank
3.2.0-89.127
-
linux-image-3.2.0-89-generic-pae
3.2.0-89.127
-
linux-image-3.2.0-89-powerpc64-smp
3.2.0-89.127
-
linux-image-3.2.0-89-omap
3.2.0-89.127
-
linux-image-3.2.0-89-generic
3.2.0-89.127
-
linux-image-3.2.0-89-powerpc-smp
3.2.0-89.127
-
linux-image-3.2.0-89-virtual
3.2.0-89.127
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References
USN-2714-1: Linux kernel (OMAP4) vulnerabilities
Ubuntu Security Notice USN-2714-1
17th August, 2015
linux-ti-omap4 vulnerabilities
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 12.04 LTS
Summary
Several security issues were fixed in the kernel.
Software description
- linux-ti-omap4
– Linux kernel for OMAP4
Details
Marcelo Ricardo Leitner discovered a race condition in the Linux kernel’s
SCTP address configuration lists when using Address Configuration Change
(ASCONF) options on a socket. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash). (CVE-2015-3212)
A flaw was discovered in how the Linux kernel handles invalid UDP
checksums. A remote attacker could exploit this flaw to cause a denial of
service using a flood of UDP packets with invalid checksums.
(CVE-2015-5364)
A flaw was discovered in how the Linux kernel handles invalid UDP
checksums. A remote attacker can cause a denial of service against
applications that use epoll by injecting a single packet with an invalid
checksum. (CVE-2015-5366)
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 12.04 LTS:
-
linux-image-3.2.0-1469-omap4
3.2.0-1469.90
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References
USN-2715-1: Linux kernel (Trusty HWE) vulnerability
Ubuntu Security Notice USN-2715-1
17th August, 2015
linux-lts-trusty vulnerability
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 12.04 LTS
Summary
The system could be made to crash under certain conditions.
Software description
- linux-lts-trusty
– Linux hardware enablement kernel from Trusty
Details
Marcelo Ricardo Leitner discovered a race condition in the Linux kernel’s
SCTP address configuration lists when using Address Configuration Change
(ASCONF) options on a socket. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash).
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 12.04 LTS:
-
linux-image-3.13.0-62-generic-lpae
3.13.0-62.102~precise1
-
linux-image-3.13.0-62-generic
3.13.0-62.102~precise1
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.