F5 BIG-IP before 12.0.0 HF3 allows remote authenticated users to modify the account configuration of users with the Resource Administration role and gain privilege via a crafted external Extended Application Verification (EAV) monitor script.
Monthly Archives: June 2016
CVE-2016-5301
The parse_chunk_header function in libtorrent before 1.1.1 allows remote attackers to cause a denial of service (crash) via a crafted (1) HTTP response or possibly a (2) UPnP broadcast.
CVE-2016-5360
HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.
‘Fansmitter’ malware can extract data from air-gapped computers
Fansmitter, a new malware with the capability to extract data from air-gapped computers, has been developed by scientists in Israel.
The post ‘Fansmitter’ malware can extract data from air-gapped computers appeared first on We Live Security.
CEEA-2016:1375 CentOS 7 qla2xxx Enhancement Update
CentOS Errata and Enhancement Advisory 2016:1375 Upstream details at : https://rhn.redhat.com/errata/RHEA-2016-1375.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 08a6bc752e27c15e9416e7e517f3d8196230222a0b48500feabb503a51526233 kmod-qla2xxx-8.07.00.33.07.3_k-1.el7_2.x86_64.rpm Source: 8c3640fe32a123a6f1630d3f3be4007be5c3a3bcbac94a6ea37c5ff21b921456 qla2xxx-8.07.00.33.07.3_k-1.el7_2.src.rpm
CVE-2016-2141
JGroups before 4.0 does not require the proper headers for the ENCRYPT and AUTH protocols from nodes joining the cluster, which allows remote attackers to bypass security restrictions and send and receive messages within the cluster via unspecified vectors.
CVE-2016-4057
Huawei FusionCompute before V100R005C10SPC700 allows remote authenticated users to cause a denial of service (resource consumption) via a large number of crafted packets.
CVE-2016-4086
Huawei HiSuite (In China) before 4.0.4.301 and (Out of China) before 4.0.4.204_ove allows remote attackers to install arbitrary apps on a connected phone via unspecified vectors.
CVE-2016-4474
The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) director (aka overcloud-full) use a default root password of ROOTPW, which allows attackers to gain access via unspecified vectors.
CVE-2016-5230
Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to bypass permission checks and control partial module functions via a crafted app.