PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abspath variable.
Monthly Archives: October 2014
CVE-2010-5077
server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of service (network traffic amplification) via a spoofed (1) getstatus or (2) rcon request.
CVE-2012-1111
lightdm before 1.0.9 does not properly close file descriptors before opening a child process, which allows local users to write to the lightdm log or have other unspecified impact.
CVE-2011-2702
Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization, allows context-dependent attackers to execute arbitrary code via a negative length parameter to (1) memcpy-ssse3-rep.S, (2) memcpy-ssse3.S, or (3) memset-sse2.S in sysdeps/i386/i686/multiarch/, which triggers an out-of-bounds read, as demonstrated using the memcpy function.
How do open source tools stay secure?
Security of open source code is a hot topic, what with Heartbleed, Shellshock, and Poodle making the news. Open source code is now widely used everywhere, from big enterprises to small businesses. This recorded webinar discusses how to keep open source tools secure,
The post How do open source tools stay secure? appeared first on We Live Security.
![]()
Shellshock Exploits Targeting SMTP Servers at Webhosts
SANS Internet Storm Center reports attacks against SMTP servers using Shellshock exploits to create a DDoS botnet.
USN-2389-1: libxml2 vulnerability
Ubuntu Security Notice USN-2389-1
27th October, 2014
libxml2 vulnerability
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary
libxml2 could be made to consume resources if it processed a specially
crafted file.
Software description
- libxml2
– GNOME XML library
Details
It was discovered that libxml2 would incorrectly perform entity
substitution even when requested not to. If a user or automated system were
tricked into opening a specially crafted document, an attacker could
possibly cause resource consumption, resulting in a denial of service.
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 14.04 LTS:
-
libxml2
2.9.1+dfsg1-3ubuntu4.4
- Ubuntu 12.04 LTS:
-
libxml2
2.7.8.dfsg-5.1ubuntu4.11
- Ubuntu 10.04 LTS:
-
libxml2
2.7.6.dfsg-1ubuntu1.15
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make
all the necessary changes.
References
Fever Pitch: Live Final is inspiration to us all
By the time I arrived for The Pitch Live Final on 23rd October, 1,000 of the original competition entrants had been whittled down to just 30 of Britainâs brightest new entrepreneurial talents. The event was held in Bristol, a city well-known for its strong start-up culture, its growing reputation as a technology hub and enlightened University initiatives. I took my place alongside my three fellow panellists: Karen Darby of CrowdMission; Lara Morgan of Company Shortcuts and Charles Carter of ICAEW. Ours was the unenviable task of deciding which one of these great new business ideas should be the overall competition winner. Judgement day was upon us.

We heard inspirational stories from guest speaker entrepreneurs who had successfully completed their journey interspersed with pitches from the finalists all of whom demonstrated no shortage of creative flare, energy and passion of their own. Listening to them some common themes began to emerge including:
- Concern for personal safety â a number of the finalists had developed products aimed at enhancing personal safety. For example, personal illumination for cyclists/motorcyclists; reflective clothing for pedestrians and detection of harmful levels of radon in buildings.
- Ways of utilizing social media to make life better â social media has become so pervasive and influential that more and more entrepreneurs are spotting ways to use it to deliver better, more satisfying life experiences for their peers. Among these were: a safe, intuitive way for people to meet like-minded individuals in bars and clubs; last minute promotions at events and in restaurants; twitter-driven ad campaigns that cut out expense of using creative agencies; simulated interactive motor racing for adults; a more effective way to search for ski holidays; software to inspire the imaginations of young children into creating their own stories.
- The emergence of social enterprise â companies whose sole purpose is to serve their communities and society at large. Representatives here included: a charity project aimed at helping struggling families in Newquay; two ideas aiming to improve finance/numeracy among children and adults by making it fun; childrenâs books featuring positive role models in business to encourage the next generation of entrepreneurs; an audio version of Twitter for the vision-impaired.
- Finally there were examples of good old fashioned innovation such as: flight bags to transform business travel; advertising space on takeaway coffee cup holders; innovative maternity clothing; a lubricated applicator for fitting surgical stockings to prevent Deep Vein Thrombosis.

Certainly the business pitches made to the judges were of a very high calibre. I personally found it found it all very inspiring and a little bit of Christmas for the brain. Deciding on a top five and eventual winner was no easy task. Finally, after much deliberation, propertECO , the company that tests buildings for cancer-causing radon, was chosen as the competition winner.
It was particularly thrilling to see Rebecca Coates, co-founder of propertCEO, crowned the champion, as she became the first female winner of The Pitch since the competitionâs inception in 2008! In fact, women entrepreneurs were well represented in this yearâs competition, earning 10 out of the 30 finalists.
Congratulations to Rebecca and all the finalists!  In fact everyone taking part deserved to be considered winners for creating a display of ingenuity and inventiveness that may one day benefit all our lives. Photographs capturing the atmosphere of the event have been uploaded to the AVG Flickr account and may be viewed here.
Iâll close by saying; AVGâs active participation in the year-long competition was an extremely positive experience. Perhaps most important of all, it has provided AVG with an invaluable platform to engage directly with the small business community. And, hopefully we have started to make a lasting impression on their consciousness.
To sum up, the real winner isâ¦â¦all of us!
![]()
![]()
Google Youtube Filter Bypass / Cross Site Scripting
Google Youtube suffered from filter bypass and persistent cross site scripting vulnerabilities.