1. Vulnerabilities in Trend Micro
OfficeScan
[10/04/2015]
Vulnerabilities were identified in the Trend
Micro OfficeScan 11.0. An attacker could bypass security restrictions, cause a
denial of service condition and crash the system. These vulnerabilities affect
versions prior to Server Build 1639 and Agent Module Build 1417 of the mentioned
products. Security patches are available to resolve these
vulnerabilities.
URL:files.trendmicro.com/documentation/readme/osce_11_patch1_win_all_criticalpatch_1639_readme.txt
2. Vulnerabilities in Huawei FusionSphere products
(Huawei-SA-20150327-01-Xen)
[10/04/2015] Vulnerabilities were identified in multiple Huawei
FusionSphere products. An attacker could bypass security restrictions, obtain
sensitive information, gain elevated privileges, execute arbitrary code, cause a
denial of service condition and compromise the system. These vulnerabilities
affect multiple versions of the mentioned products. Security patches are
available to resolve these
vulnerabilities.
URL:www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-423503.htm
3. Vulnerabilities in Novell Products (5203090, 5203091,
5203092, 5203093, 5203094, 5204618)
[10/04/2015] Vulnerabilities were identified in the Novell NetIQ
eDirectory and Novell iManager. An attacker could bypass security restriction,
obtain sensitive information, gain elevated privileges, execute arbitrary code,
cause a denial of service condition and crash the system. These vulnerabilities
affect multiple versions of the mentioned products. Security patches are
available to resolve these
vulnerabilities.
URL:download.novell.com/Download?buildid=0xfWWTKtbP8~
URL:download.novell.com/Download?buildid=HC2GixnAgPU~
URL:download.novell.com/Download?buildid=K9TBoAJEHw8~
URL:download.novell.com/Download?buildid=N8vYScT2aao~
URL:download.novell.com/Download?buildid=qE1qo94Rxsc~
URL:download.novell.com/Download?buildid=uq64QLv_TVc~
4. Vulnerabilities in F5 Products (SOL16285, SOL16344,
SOL16347, SOL16380, SOL16381, SOL16385, SOL16389, SOL16392, SOL16393, SOL16396,
SOL16398)
[10/04/2015]
Vulnerabilities were identified in the F5 BIG-IP
LTM, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM, BIG-IP ASM, BIG-IP
Edge Gateway, BIG-IP GTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IP PSM, BIG-IP
WebAccelerator, BIG-IP WOM, ARX, Enterprise Manager, FirePass, BIG-IQ Cloud,
BIG-IQ Device, BIG-IQ Security, BIG-IQ-ADC, LineRate, and Traffic SDC. An
attacker could bypass security restrictions, obtain sensitive information, gain
elevated privileges, cause a denial of service condition and crash the system.
These vulnerabilities affect multiple versions of the mentioned products.
Security patches are available to resolve these
vulnerabilities.
URL:support.f5.com/kb/en-us/solutions/public/16000/200/sol16285.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16344.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16347.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16380.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16381.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16385.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16389.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16392.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16393.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16396.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16398.html
5. Vulnerability in WP Super Cache plugin for
WordPress
[10/04/2015]
Vulnerability was identified in the WP Super
Cache plugin for WordPress. An attacker could bypass security restrictions,
execute arbitrary code and perform cross-site scripting attacks. This
vulnerability affects versions prior to 1.4.4 of the mentioned product. Security
patches are available to resolve this
vulnerability.
URL:wordpress.org/plugins/wp-super-cache/changelog/
URL:www.us-cert.gov/ncas/current-activity/2015/04/09/WP-Super-Cache-Cross-Site-Scripting-XSS-Vulnerability
6. Security Updates in Oracle Linux
(ELSA-2015-0794)
[10/04/2015] Oracle has
released security update packages for fixing the vulnerabilities identified in
the krb5 package for Oracle Linux 6. Due to multiple errors, an attacker could
bypass security restrictions, obtain sensitive information, execute arbitrary
code, cause a denial of service condition and crash the
system.
URL:linux.oracle.com/errata/ELSA-2015-0794.html
7. Security Updates in Debian
(DSA-3217-1)
[10/04/2015] Debian has
released security update packages for fixing the vulnerability identified in the
dpkg package for multiple versions of Debian GNU/Linux. An attacker could bypass
security
restrictions.
URL:www.debian.org/security/2015/dsa-3217
8. Security Updates in FreeBSD (FreeBSD-SA-15:07.ntp,
FreeBSD-SA-15:08.bsdinstall, FreeBSD-SA-15:09.ipv6)
[10/04/2015] FreeBSD has released security update packages for fixing the
vulnerabilities identified in the ntp, bsdinstall and ipv6 packages for multiple
versions of FreeBSD. Due to multiple errors, an attacker could bypass security
restrictions, obtain sensitive information, execute arbitrary code, cause a
denial of service condition and crash the
system.
URL:www.freebsd.org/security/advisories/FreeBSD-SA-15:07.ntp.asc
URL:www.freebsd.org/security/advisories/FreeBSD-SA-15:08.bsdinstall.asc
URL:www.freebsd.org/security/advisories/FreeBSD-SA-15:09.ipv6.asc
9. Security Updates in Mageia (MGASA-2015-0135,
MGASA-2015-0136, MGASA-2015-0137, MGASA-2015-0138, MGASA-2015-0139,
MGASA-2015-0140, MGASA-2015-0141, MGASA-2015-0142,
MGASA-2015-0143)
[10/04/2015] Mageia has
released security update packages for fixing the vulnerabilities identified in
the suricata, xerces-c, qt-creator, batik, less, jakarta-taglibs-standard,
chromium-browser-stable, mediawiki and openldap packages for multiple versions
of Mageia. Due to multiple errors, an attacker could bypass security
restrictions, obtain sensitive information, gain elevated privileges, execute
arbitrary code, cause a denial of service condition and compromise the
system.
URL:advisories.mageia.org/MGASA-2015-0135.html
URL:advisories.mageia.org/MGASA-2015-0136.html
URL:advisories.mageia.org/MGASA-2015-0137.html
URL:advisories.mageia.org/MGASA-2015-0138.html
URL:advisories.mageia.org/MGASA-2015-0139.html
URL:advisories.mageia.org/MGASA-2015-0140.html
URL:advisories.mageia.org/MGASA-2015-0141.html
URL:advisories.mageia.org/MGASA-2015-0142.html
URL:advisories.mageia.org/MGASA-2015-0143.html
10.
Security Updates in Mandriva
(MDVSA-2015:161-1, MDVSA-2015:187, MDVSA-2015:188, MDVSA-2015:189,
MDVSA-2015:190, MDVSA-2015:191, MDVSA-2015:192, MDVSA-2015:193, MDVSA-2015:195,
MDVSA-2015:196, MDVSA-2015:198)
[10/04/2015] Mandriva
has released security update packages for fixing the vulnerabilities identified
in the icu, graphviz, flac, tor, owncloud, subversion, libtasn1, python-django,
cups-filters and java-1.8.0-openjdk packages for versions MBS1 and MBS2 of
Mandriva GNU/Linux. Due to multiple errors, an attacker could bypass security
restrictions, obtain sensitive information, gain elevated privileges, execute
arbitrary code, cause a denial of service condition and compromise the
system.
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A161-1/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A187/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A188/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A189/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A190/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A191/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A192/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A193/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A195/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A196/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A198/
11.
Security Updates in Red Hat Enterprise
Linux (RHSA-2015:0794-1, RHSA-2015:0795-1)
[10/04/2015] Red Hat
has released security update packages for fixing the vulnerabilities identified
in the krb5 package for Red Hat Enterprise Linux 6, and qemu-kvm-rhev package
for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux
7. Due to multiple errors, an attacker could bypass security restriction, obtain
sensitive information, gain elevated privileges, execute arbitrary code, cause a
denial of service condition and crash the
system.
URL:rhn.redhat.com/errata/RHSA-2015-0794.html
URL:rhn.redhat.com/errata/RHSA-2015-0795.html
12.
Security Updates in Ubuntu GNU/Linux
(USN-2564-1, USN-2565-1, USN-2566-1)
[10/04/2015] Ubuntu has
released security update packages for fixing the vulnerabilities identified in
the linux-lts-utopic, linux and dpkg packages for versions 10.04 LTS, 12.04 LTS,
14.04 LTS and 14.10 of Ubuntu GNU/Linux. Due to multiple errors, an attacker
could bypass security restrictions, obtain sensitive information, gain elevated
privileges, execute arbitrary code, cause a denial of service condition and
compromise the
system.
URL:www.ubuntu.com/usn/usn-2564-1/
URL:www.ubuntu.com/usn/usn-2565-1/
URL:www.ubuntu.com/usn/usn-2566-1/
13.
Vulnerabilities in Apple Products
(HT204658, HT204659, HT204661, HT204662, HT204663)
[09/04/2015] Vulnerabilities were identified in the Apple Safari, Apple OS
X Yosemite, Apple iOS, Apple TV and Apple Xcode. An attacker could bypass
security restrictions, obtain sensitive information, gain elevated privileges,
execute arbitrary code, cause a denial of service condition and compromise the
system. These vulnerabilities affect multiple versions of the mentioned
products. Security patches are available to resolve these
vulnerabilities.
URL:support.apple.com/en-us/HT204658
URL:support.apple.com/en-us/HT204659
URL:support.apple.com/en-us/HT204661
URL:support.apple.com/en-us/HT204662
URL:support.apple.com/en-us/HT204663
URL:prod.lists.apple.com/archives/security-announce/2015/Apr/msg00000.html
URL:prod.lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
URL:prod.lists.apple.com/archives/security-announce/2015/Apr/msg00002.html
URL:prod.lists.apple.com/archives/security-announce/2015/Apr/msg00003.html
URL:prod.lists.apple.com/archives/security-announce/2015/Apr/msg00004.html
URL:www.hkcert.org/my_url/en/alert/15040901
URL:www.us-cert.gov/ncas/current-activity/2015/04/08/Apple-Releases-Security-Updates-OS-X-iOS-Safari-and-Apple-TV
14.
Vulnerabilities in Cisco Products
(cisco-sa-20150408-asa, cisco-sa-20150408-cxfp,
cisco-sa-20150408-ntpd)
[09/04/2015] Vulnerabilities were identified in multiple Cisco products.
An attacker could bypass security restrictions, obtain sensitive information,
gain elevated privileges, execute arbitrary code, cause a denial of service
condition and compromise the system. These vulnerabilities affect multiple
firmware versions of the mentioned products. Security patches are available to
resolve these
vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-cxfp
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-ntpd
15.
Vulnerabilities in IBM Notes and Domino
(1701319)
[09/04/2015]
Vulnerabilities were identified in the IBM Notes
and Domino. An attacker could bypass security restrictions, obtain sensitive
information, gain elevated privileges, execute arbitrary code, cause a denial of
service condition and crash the system. An attacker could bypass security
restrictions, obtain sensitive information and execute arbitrary code. These
vulnerabilities affect multiple versions of the mentioned products. Security
patches are available to resolve these
vulnerabilities.
URL:www.ibm.com/support/docview.wss?uid=swg21701319
16.
Vulnerabilities in Juniper Products
(JSA10672, JSA10673, JSA10674, JSA10675, JSA10676, JSA10677, JSA10678, JSA10679,
JSA10680)
[09/04/2015]
Vulnerabilities were identified in multiple
Juniper products. An attacker could bypass security restrictions, obtain
sensitive information, gain elevated privileges, execute arbitrary code, cause a
denial of service condition and compromise the system. These vulnerabilities
affect multiple versions of the mentioned products. Security patches are
available to resolve these
vulnerabilities.
URL:kb.juniper.net/index?page=content&id=JSA10672
URL:kb.juniper.net/index?page=content&id=JSA10673
URL:kb.juniper.net/index?page=content&id=JSA10674
URL:kb.juniper.net/index?page=content&id=JSA10675
URL:kb.juniper.net/index?page=content&id=JSA10676
URL:kb.juniper.net/index?page=content&id=JSA10677
URL:kb.juniper.net/index?page=content&id=JSA10678
URL:kb.juniper.net/index?page=content&id=JSA10679
URL:kb.juniper.net/index?page=content&id=JSA10680
17.
Vulnerabilities in Novell Products
(5203090, 5203091, 5203092, 5203093, 5203094, 5204618, 5206551, 5206570,
5206590)
[09/04/2015]
Vulnerabilities were identified in the Novell
Identity Manager, Novell NetIQ eDirectory and Novell iManager. An attacker could
bypass security restriction, obtain sensitive information, gain elevated
privileges, execute arbitrary code, cause a denial of service condition and
crash the system. These vulnerabilities affect multiple versions of the
mentioned products. Security patches are available to resolve these
vulnerabilities.
URL:download.novell.com/Download?buildid=_WYyICODfL8~
URL:download.novell.com/Download?buildid=0xfWWTKtbP8~
URL:download.novell.com/Download?buildid=6F0mcIA5UQs~
URL:download.novell.com/Download?buildid=HC2GixnAgPU~
URL:download.novell.com/Download?buildid=K9TBoAJEHw8~
URL:download.novell.com/Download?buildid=N8vYScT2aao~
URL:download.novell.com/Download?buildid=oJ3evaNQb2M~
URL:download.novell.com/Download?buildid=qE1qo94Rxsc~
URL:download.novell.com/Download?buildid=uq64QLv_TVc~
18.
Vulnerability in X-Cart
(VU#924124)
[09/04/2015] Vulnerability was identified in the X-Cart. An attacker could
bypass security restrictions, obtain sensitive information and execute arbitrary
code. This vulnerability affects versions 5.1.6 through 5.1.10 of the mentioned
product. Security patches are available to resolve this
vulnerability.
URL:www.kb.cert.org/vuls/id/924124
19.
Security Updates in Oracle Linux
(ELSA-2015-0783-1)
[09/04/2015] Oracle has
released security update packages for fixing the vulnerabilities identified in
the kernel package for Oracle Linux 5. Due to multiple errors, an attacker could
bypass security restrictions, obtain sensitive information, gain elevated
privileges, execute arbitrary code, cause a denial of service condition and
crash the
system.
URL:linux.oracle.com/errata/ELSA-2015-0783-1.html
20.
Security Updates in Mandriva
(MDVSA-2015:017-1, MDVSA-2015:029-1, MDVSA-2015:167-1, MDVSA-2015:168-1,
MDVSA-2015:169, MDVSA-2015:170, MDVSA-2015:171, MDVSA-2015:172, MDVSA-2015:173,
MDVSA-2015:174, MDVSA-2015:175, MDVSA-2015:176, MDVSA-2015:177, MDVSA-2015:178,
MDVSA-2015:179, MDVSA-2015:180, MDVSA-2015:181, MDVSA-2015:182, MDVSA-2015:183,
MDVSA-2015:184, MDVSA-2015:185, MDVSA-2015:186)
[09/04/2015] Mandriva has released security update packages for fixing the
vulnerabilities identified in the libevent, binutils, glpi, glibc, git, gcc,
freerdp, firebird, ffmpeg, erlang, ejabberd, dbus, ctdb, ctags, coreutils,
apache-mod_wsgi, drupal, tcpdump, wireshark, setup, dokuwiki and phpmyadmin
packages for versions MBS1 and MBS2 of Mandriva GNU/Linux. Due to multiple
errors, an attacker could bypass security restrictions, obtain sensitive
information, gain elevated privileges, execute arbitrary code, cause a denial of
service condition and compromise the
system.
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A017-1/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A029-1/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A167/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A168/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A169/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A170/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A171/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A172/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A173/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A174/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A175/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A176/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A177/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A178/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A179/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A180/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A181/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A182/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A183/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A184/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A185/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A186/
21.
Security Updates in Red Hat Enterprise
Linux (RHSA-2015:0776-1, RHSA-2015:0778-1, RHSA-2015:0782-1, RHSA-2015:0783-1,
RHSA-2015:0788-1)
[09/04/2015] Red Hat
has released security update packages for fixing the vulnerabilities identified
in the docker, chromium-browser and kernel packages for Red Hat Enterprise Linux
5, 6 and 7, and novnc package for Red Hat Enterprise Linux OpenStack Platform
6.0. Due to multiple errors, an attacker could bypass security restriction,
obtain sensitive information, gain elevated privileges, execute arbitrary code,
cause a denial of service condition and crash the
system.
URL:rhn.redhat.com/errata/RHSA-2015-0776.html
URL:rhn.redhat.com/errata/RHSA-2015-0778.html
URL:rhn.redhat.com/errata/RHSA-2015-0782.html
URL:rhn.redhat.com/errata/RHSA-2015-0783.html
URL:rhn.redhat.com/errata/RHSA-2015-0788.html
22.
Security Updates in SUSE
(openSUSE-SU-2015:0677-1, openSUSE-SU-2015:0682-1)
[09/04/2015] SUSE has released security update packages for fixing the
vulnerabilities identified in the MozillaFirefox, MozillaThunderbird,
mozilla-nspr and Chromium packages of openSUSE 13.1 and 13.2. Due to multiple
errors, an attacker could bypass security restrictions, obtain sensitive
information, gain elevated privileges, execute arbitrary code, cause a denial of
service condition and compromise the
system.
URL:lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html
URL:lists.opensuse.org/opensuse-security-announce/2015-04/msg00004.html
23.
Security Updates in Ubuntu GNU/Linux
(USN-2559-1, USN-2560-1, USN-2561-1, USN-2562-1,
USN-2563-1)
[09/04/2015] Ubuntu has
released security update packages for fixing the vulnerabilities identified in
the libtasn1-3, libtasn1-6, linux, linux-ti-omap4 and linux-lts-trusty packages
for versions 10.04 LTS, 12.04 LTS, 14.04 LTS and 14.10 of Ubuntu GNU/Linux. Due
to multiple errors, an attacker could bypass security restrictions, obtain
sensitive information, gain elevated privileges, execute arbitrary code, cause a
denial of service condition and compromise the
system.
URL:www.ubuntu.com/usn/usn-2559-1/
URL:www.ubuntu.com/usn/usn-2560-1/
URL:www.ubuntu.com/usn/usn-2561-1/
URL:www.ubuntu.com/usn/usn-2562-1/
URL:www.ubuntu.com/usn/usn-2563-1/
24.
Vulnerabilities in Mozilla Firefox (MFSA
2015-43, MFSA 2015-44)
[08/04/2015] Vulnerabilities were identified in Mozilla Firefox. An
attacker could bypass security restriction, obtain sensitive information, gain
elevated privileges, execute arbitrary code and perform man-in-the-middle
attacks. These vulnerabilities affect multiple versions prior to 37.0.1 of the
mentioned product. Security patches are available for Firefox to resolve these
vulnerabilities.
URL:www.mozilla.org/en-US/security/advisories/mfsa2015-43/
URL:www.mozilla.org/en-US/security/advisories/mfsa2015-44/
URL:www.mozilla.org/en-US/security/known-vulnerabilities/firefox/
URL:exchange.xforce.ibmcloud.com/vulnerabilities/102056
URL:exchange.xforce.ibmcloud.com/vulnerabilities/102057
25.
Vulnerability in Apache Flex
(102055)
[08/04/2015]
Vulnerability was identified in the Apache Flex.
An attacker could bypass security restrictions, execute arbitrary code and
perform cross-site scripting attacks. This vulnerability affects versions prior
to 4.14.1 of the mentioned product. Security patches are available to resolve
this
vulnerability.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/102055
26.
Vulnerabilities in Network Time Protocol
(VU#374268)
[08/04/2015] Vulnerabilities were identified in the Network Time Protocol
(NTP). An attacker could bypass security restrictions, cause a denial of service
condition and crash the system. These vulnerabilities affect versions prior to
4.2.8p2 of the mentioned product. Security patches are available to resolve
these
vulnerabilities.
URL:www.kb.cert.org/vuls/id/374268
URL:exchange.xforce.ibmcloud.com/vulnerabilities/102051
URL:exchange.xforce.ibmcloud.com/vulnerabilities/102052
27.
Vulnerability in VMware Products
(VMSA-2015-0003)
[08/04/2015] Vulnerability was identified in multiple VMware products. An
attacker could bypass security restrictions and obtain sensitive information.
This vulnerability affects multiple versions of the mentioned products. Security
patches are available to resolve this
vulnerability.
URL:www.vmware.com/security/advisories/VMSA-2015-0003.html
28.
Vulnerabilities in F5 Products (SOL16318,
SOL16321, SOL16337, SOL16341, SOL16345, SOL16355, SOL16356, SOL16364,
SOL16365)
[08/04/2015]
Vulnerabilities were identified in the F5 BIG-IP
LTM, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM, BIG-IP ASM, BIG-IP
Edge Gateway, BIG-IP GTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IP PSM, BIG-IP
WebAccelerator, BIG-IP WOM, ARX, Enterprise Manager, BIG-IQ Cloud, BIG-IQ
Device, BIG-IQ Security and LineRate. An attacker could bypass security
restrictions, obtain sensitive information, gain elevated privileges, cause a
denial of service condition and crash the system. These vulnerabilities affect
multiple versions of the mentioned products. Security patches are available to
resolve these
vulnerabilities.
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16318.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16321.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16337.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16341.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16345.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16355.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16356.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16364.html
URL:support.f5.com/kb/en-us/solutions/public/16000/300/sol16365.html
29.
Vulnerability in PHP Event Calendar
plugin for WordPress (102018)
[08/04/2015] Vulnerability was identified in the PHP Event Calendar plugin
for WordPress. An attacker could bypass security restrictions and execute
arbitrary code. This vulnerability affects version 1.5 of the mentioned
product.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/102018
30.
Security Updates in Oracle Linux
(ELSA-2015-3022)
[08/04/2015] Oracle has
released security update packages for fixing the vulnerabilities identified in
the openssl-fips package for Oracle Linux 6. Due to multiple errors, an attacker
could bypass security restrictions, obtain sensitive information, gain elevated
privileges, execute arbitrary code, cause a denial of service condition and
compromise the
system.
URL:linux.oracle.com/errata/ELSA-2015-3022.html
31.
Security Updates in Debian (DSA-3212-1,
DSA-3213-1, DSA-3214-1, DSA-3215-1, DSA-3216-1)
[08/04/2015] Debian has released security update packages for fixing the
vulnerabilities identified in the icedove, arj, mailman, libgd2 and tor packages
for multiple versions of Debian GNU/Linux. Due to multiple errors, an attacker
could bypass security restrictions, obtain sensitive information, gain elevated
privileges, execute arbitrary code, cause a denial of service condition and
crash the
system.
URL:www.debian.org/security/2015/dsa-3212
URL:www.debian.org/security/2015/dsa-3213
URL:www.debian.org/security/2015/dsa-3214
URL:www.debian.org/security/2015/dsa-3215
URL:www.debian.org/security/2015/dsa-3216
32.
Security Updates in Gentoo Linux (GLSA
201504-01)
[08/04/2015]
Gentoo has released security update packages for
fixing the vulnerabilities identified in the firefox, firefox-bin, thunderbird,
thunderbird-bin, seamonkey, seamonkey-bin and nspr packages for multiple
versions of Gentoo Linux. Due to multiple errors, an attacker could bypass
security restrictions, obtain sensitive information, execute arbitrary code,
perform clickjacking and Man-in-the-Middle attacks, cause a denial of service
condition and crash the
system.
URL:security.gentoo.org/glsa/201504-01
33.
Security Updates in Mandriva
(MDVSA-2015:146, MDVSA-2015:147-1, MDVSA-2015:148-1, MDVSA-2015:149,
MDVSA-2015:150, MDVSA-2015:151, MDVSA-2015:152, MDVSA-2015:153, MDVSA-2015:154,
MDVSA-2015:155, MDVSA-2015:156, MDVSA-2015:157, MDVSA-2015:158, MDVSA-2015:159,
MDVSA-2015:160, MDVSA-2015:161, MDVSA-2015:162, MDVSA-2015:163, MDVSA-2015:164,
MDVSA-2015:165, MDVSA-2015:166)
[08/04/2015] Mandriva
has released security update packages for fixing the vulnerabilities identified
in the libvncserver, libtiff, libssh2, libsndfile, liblzo, libksba, libjpeg,
libgd, gnupg, libcap-ng, libarchive, jython, jasper, ipython, icu, gtk+3.0,
grub2, bash, bind and clamav packages for versions MBS1 and MBS2 of Mandriva
GNU/Linux. Due to multiple errors, an attacker could bypass security
restrictions, obtain sensitive information, gain elevated privileges, execute
arbitrary code, cause a denial of service condition and compromise the
system.
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A146/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A147-1/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A148-1/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A149/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A150/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A151/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A152/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A153/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A154/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A155/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A156/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A157/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A158/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A159/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A160/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A161/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A162/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A163/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A164/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A165/
URL:www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015%3A166/
34.
Security Updates in Mageia
(MGASA-2015-0126, MGASA-2015-0127, MGASA-2015-0128, MGASA-2015-0129,
MGASA-2015-0130, MGASA-2015-0131, MGASA-2015-0132, MGASA-2015-0133,
MGASA-2015-0134)
[08/04/2015] Mageia has
released security update packages for fixing the vulnerabilities identified in
the iceape, python-django, python-django14, libtasn1, mercurial, mongodb,
rootcerts, nss, firefox, firefox-l10n, thunderbird, thunderbird-l10n,
cups-filters, novnc, php, php-apc and libzip packages for multiple versions of
Mageia. Due to multiple errors, an attacker could bypass security restrictions,
obtain sensitive information, gain elevated privileges, execute arbitrary code,
cause a denial of service condition and compromise the
system.
URL:advisories.mageia.org/MGASA-2015-0126.html
URL:advisories.mageia.org/MGASA-2015-0127.html
URL:advisories.mageia.org/MGASA-2015-0128.html
URL:advisories.mageia.org/MGASA-2015-0129.html
URL:advisories.mageia.org/MGASA-2015-0130.html
URL:advisories.mageia.org/MGASA-2015-0131.html
URL:advisories.mageia.org/MGASA-2015-0132.html
URL:advisories.mageia.org/MGASA-2015-0133.html
URL:advisories.mageia.org/MGASA-2015-0134.html
35.
Security Updates in SUSE
(SUSE-SU-2015:0652-1, SUSE-SU-2015:0658-1,
SUSE-SU-2015:0674-1)
[08/04/2015] SUSE has
released security update packages for fixing the vulnerabilities identified in
the Linux kernel and xorg-x11-libs packages of SUSE Linux Enterprise 11 and 12.
Due to multiple errors, an attacker could bypass security restrictions, obtain
sensitive information, gain elevated privileges, execute arbitrary code, cause a
denial of service condition and compromise the
system.
URL:lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
URL:lists.opensuse.org/opensuse-security-announce/2015-04/msg00001.html
URL:lists.opensuse.org/opensuse-security-announce/2015-04/msg00002.html
36.
Security Updates in Ubuntu GNU/Linux
(USN-2552-1, USN-2556-1, USN-2557-1, USN-2558-1)
[08/04/2015] Ubuntu has released security update packages for fixing the
vulnerabilities identified in the thunderbird, oxide-qt, firefox and mailman
packages for versions 12.04 LTS, 14.04 LTS and 14.10 of Ubuntu GNU/Linux. Due to
multiple errors, an attacker could bypass security restrictions, obtain
sensitive information, gain elevated privileges, execute arbitrary code, perform
cross-site request forgery (XSRF) and man-in-the middle attacks, cause a denial
of service condition and compromise the
system.
URL:www.ubuntu.com/usn/usn-2552-1/
URL:www.ubuntu.com/usn/usn-2556-1/
URL:www.ubuntu.com/usn/usn-2557-1/
URL:www.ubuntu.com/usn/usn-2558-1/
Malware Alert
[10/04/2015] AAEH is a
family of polymorphic downloaders with the primary purpose of downloading other
malware, including password stealers, rootkits, fake antivirus, and ransomware.
It propagates across networks, removable drives (USB/CD/DVD), and through ZIP
and RAR archive files. Once installed, it morphs every few hours and rapidly
spreads across the network.
A system infected
with AAEH may be employed to distribute malicious software, collect users'
credentials for online services and extort money from users by encrypting key
files. AAEH is capable of defeating anti-virus products by blocking connections
to IP addresses associated with Internet security companies and by preventing
anti-virus tools from running on infected machines.
This malware runs
on Windows 95, 98, Me, 2000, XP, Vista, 7, 8, Windows Server 2003, 2008, 2008 R2
and Windows Server 2012. Malware signatures and removal procedures are available
from most anti-virus vendors. For more information about this malware, please
refer to the following link:
URL:www.us-cert.gov/ncas/alerts/TA15-098AURL:www.europol.europa.eu/content/international-police-operation-targets-polymorphic-beebone-botnetURL:www.mcafee.com/threat-intelligence/malware/default.aspx?id=1607456URL:www.symantec.com/security_response/writeup.jsp?docid=2009-081806-2906-99URL:www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_agent.aaeh
No comments:
Post a Comment