Original release date: December 01, 2015
Google has released Chrome version 47.0.2526.73 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system.
Users and administrators are encouraged to review the Chrome Releases page and apply the necessary update.
This product is provided subject to this Notification and this Privacy & Use policy.
Zenphoto version 1.4.10 suffers from a local file inclusion vulnerability.
Zenphoto version 1.4.10 suffers from a cross site scripting vulnerability.
Huawei Wimax routers vulnerable to multiple threats
[SECURITY] [DSA 3408-1] gnutls26 security update
Zenphoto 1.4.10 XSS Vulnerability
BSides SF is soliciting papers and presentations for the 2016 annual BSidesSF conference. It will be held at the DNA Lounge, 375 11th Street, San Francisco, CA, USA on February 28th through the 29th, 2016.
1st December, 2015
A security issue affects these releases of Ubuntu and its
derivatives:
Several security issues were fixed in Thunderbird.
Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky,
Randell Jesup, Olli Pettay, Karl Tomlinson, Jeff Walden, and Gary Kwong
discovered multiple memory safety issues in Thunderbird. If a user were
tricked in to opening a specially crafted message, an attacker could
potentially exploit these to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Thunderbird. (CVE-2015-4513)
Tyson Smith and David Keeler discovered a use-after-poison and buffer
overflow in NSS. An attacker could potentially exploit these to cause a
denial of service via application crash, or execute arbitrary code with
the privileges of the user invoking Thunderbird. (CVE-2015-7181,
CVE-2015-7182)
Ryan Sleevi discovered an integer overflow in NSPR. An attacker could
potentially exploit this to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Thunderbird. (CVE-2015-7183)
Michał Bentkowski discovered that adding white-space to hostnames that are
IP addresses can bypass same-origin protections. If a user were tricked in
to opening a specially crafted website in a browser-like context, an
attacker could potentially exploit this to conduct cross-site scripting
(XSS) attacks. (CVE-2015-7188)
Looben Yang discovered a buffer overflow during script interactions with
the canvas element in some circumstances. If a user were tricked in to
opening a specially crafted website in a browser-like context, an attacker
could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Thunderbird. (CVE-2015-7189)
Shinto K Anto discovered that CORS preflight is bypassed when receiving
non-standard Content-Type headers in some circumstances. If a user were
tricked in to opening a specially crafted website in a browser-like
context, an attacker could potentially exploit this to bypass
same-origin restrictions. (CVE-2015-7193)
Gustavo Grieco discovered a buffer overflow in libjar in some
circumstances. If a user were tricked in to opening a specially crafted
website in a browser-like context, an attacker could potentially exploit
this to cause a denial of service via application crash, or execute
arbitrary code with the privileges of the user invoking Thunderbird.
(CVE-2015-7194)
Ehsan Akhgari discovered a mechanism for a web worker to bypass secure
requirements for web sockets. If a user were tricked in to opening a
specially crafted website in a browser-like context, an attacker could
exploit this to bypass the mixed content web socket policy.
(CVE-2015-7197)
Ronald Crane discovered several vulnerabilities through code-inspection. If
a user were tricked in to opening a specially crafted website in a
browser-like context, an attacker could potentially exploit these to cause
a denial of service via application crash, or execute arbitrary code with
the privileges of the user invoking Thunderbird. (CVE-2015-7198,
CVE-2015-7199, CVE-2015-7200)
The problem can be corrected by updating your system to the following
package version:
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to restart Thunderbird to make
all the necessary changes.
Ubuntu Security Notice 2823-1 – It was discovered that the SCTP protocol implementation in the Linux kernel performed an incorrect sequence of protocol-initialization steps. A local attacker could use this to cause a denial of service (system crash). Dmitry Vyukov discovered that the Linux kernel’s keyring handler attempted to garbage collect incompletely instantiated keys. A local unprivileged attacker could use this to cause a denial of service (system crash). Various other issues were also addressed.
Debian Linux Security Advisory 3408-1 – It was discovered that GnuTLS, a library implementing the TLS and SSL protocols, incorrectly validates the first byte of padding in CBC modes. A remote attacker can possibly take advantage of this flaw to perform a padding oracle attack.