Ubuntu Security Notice 3015-1 – Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash, or execute arbitrary code.
Monthly Archives: June 2016
Joomla SmartFormer 2.4.1 Shell Upload
Joomla Smartformer component version 2.4.1 suffers from a remote shell upload vulnerability.
LizardStresser IoT Botnet Part of 400Gbps DDoS Attacks
LizardStresser botnet hijacks 1,300 internet-accessible video cameras, enlisting them as pawns in 400Gbps DDoS attacks targeting Brazilian banks and several U.S. gaming firms.
Ktools Photostore 4.7.5 Blind SQL Injection
Ktools Photostore versions 4.7.5 and below suffer from a remote blind SQL injection vulnerability.
CVE-2015-8899
Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.
CVE-2016-3189
Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
CVE-2016-4309
Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter.
CVE-2016-4472
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
CVE-2016-4803
CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject.
CVE-2016-4971
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.