1. Vulnerabilities in Google Chrome
[22/01/2016] Vulnerabilities were identified in the Google Chrome. An
attacker could bypass security restrictions, obtain sensitive information, gain
elevated privileges, execute arbitrary code, cause a denial of service condition
and compromise the system. These vulnerabilities affect versions prior to
49.0.2623.0 of the mentioned product. Security patches are available to resolve
these
vulnerabilities.
URL:googlechromereleases.blogspot.hk/2016/01/stable-channel-update_20.html
URL:www.us-cert.gov/ncas/current-activity/2016/01/20/Google-Releases-Security-Update-Chrome
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109995
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109996
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109997
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109998
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109999
URL:exchange.xforce.ibmcloud.com/vulnerabilities/110000
URL:exchange.xforce.ibmcloud.com/vulnerabilities/110001
URL:exchange.xforce.ibmcloud.com/vulnerabilities/110002
URL:exchange.xforce.ibmcloud.com/vulnerabilities/110003
2. Vulnerabilities in F5 Products (SOL02360853,
SOL49580002, SOL53445000, SOL60352002, SOL62700573)
[22/01/2016] Vulnerabilities were identified in the F5 BIG-IP LTM, BIG-IP
AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM, BIG-IP ASM, BIG-IP DNS, BIG-IP
Edge Gateway, BIG-IP GTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IP PSM, BIG-IP
WebAccelerator, BIG-IP WOM, Enterprise Manager, BIG-IQ Cloud, BIG-IQ Device,
BIG-IQ Security, BIG-IQ ADC, BIG-IQ Centralized Management, BIG-IQ Cloud and
Orchestration and Traffix SDC. An attacker could bypass security restrictions,
obtain sensitive information, gain elevated privileges, execute arbitrary code,
cause a denial of service condition and crash the system. These vulnerabilities
affect multiple versions of the mentioned products. Security patches are
available to resolve these
vulnerabilities.
URL:support.f5.com/kb/en-us/solutions/public/k/02/sol02360853.html
URL:support.f5.com/kb/en-us/solutions/public/k/49/sol49580002.html
URL:support.f5.com/kb/en-us/solutions/public/k/53/sol53445000.html
URL:support.f5.com/kb/en-us/solutions/public/k/60/sol60352002.html
URL:support.f5.com/kb/en-us/solutions/public/k/62/sol62700573.html
3. Vulnerability in CAREL PlantVisor Enhanced
(ICSA-16-021-01)
[22/01/2016] Vulnerability was identified in the CAREL PlantVisor
Enhanced. An attacker could bypass security restrictions. This vulnerability
affects ALL versions of the mentioned
product.
URL:ics-cert.us-cert.gov/advisories/ICSA-16-021-01
4. Vulnerability in Hospira Products
(ICSA-15-337-02)
[22/01/2016] Vulnerability was identified in the multiple Hospira
products. An attacker could bypass security restrictions, obtain sensitive
information, gain elevated privileges, execute arbitrary code and compromise the
system. This vulnerability affects multiple versions of the mentioned products.
Security patches are available to resolve this
vulnerability.
URL:ics-cert.us-cert.gov/advisories/ICSA-15-337-02
5. Vulnerability in Harman AMX multimedia devices
(VU#992624)
[22/01/2016] Vulnerability was identified in the Harman AMX multimedia
devices. An attacker could bypass security restrictions, obtain sensitive
information, gain elevated privileges, execute arbitrary code and compromise the
system. This vulnerability affects multiple versions of the mentioned product.
Security patches are available to resolve this
vulnerability.
URL:www.kb.cert.org/vuls/id/992624
URL:exchange.xforce.ibmcloud.com/vulnerabilities/110011
6. Security Updates in Oracle Linux (ELSA-2016-0053,
ELSA-2016-0054)
[22/01/2016] Oracle has
released security update packages for fixing the vulnerabilities identified in
the java-1.7.0-openjdk packages for Oracle Linux 5, 6 and 7. Due to multiple
errors, an attacker could bypass security restrictions, obtain sensitive
information, gain elevated privileges, execute arbitrary code, cause a denial of
service condition and compromise the
system.
URL:linux.oracle.com/errata/ELSA-2016-0053.html
URL:linux.oracle.com/errata/ELSA-2016-0054.html
7. Security Updates in Mageia (MGASA-2016-0025,
MGASA-2016-0026, MGASA-2016-0027, MGASA-2016-0028, MGASA-2016-0029,
MGASA-2016-0030, MGASA-2016-0031, MGASA-2016-0032, MGASA-2016-0033,
MGASA-2016-0034)
[22/01/2016] Mageia has
released security update packages for fixing the vulnerability identified in the
cacti, encfs, perl, perl-PathTools, dhcp, moodle, bind, kernel-linus,
kernel-tmb, kernel, kernel-userspace-headers, kmod-vboxadditions,
kmod-virtualbox, kmod-xtables-addons, kmod-broadcom-wl, kmod-fglrx,
kmod-nvidia304, kmod-nvidia340, kmod-nvidia-current and dhcpcd packages for
multiple versions of Mageia. Due to multiple errors, an attacker could bypass
security restrictions, obtain sensitive information, gain elevated privileges,
execute arbitrary code, cause a denial of service condition and compromise the
system.
URL:advisories.mageia.org/MGASA-2016-0025.html
URL:advisories.mageia.org/MGASA-2016-0026.html
URL:advisories.mageia.org/MGASA-2016-0027.html
URL:advisories.mageia.org/MGASA-2016-0028.html
URL:advisories.mageia.org/MGASA-2016-0029.html
URL:advisories.mageia.org/MGASA-2016-0030.html
URL:advisories.mageia.org/MGASA-2016-0031.html
URL:advisories.mageia.org/MGASA-2016-0032.html
URL:advisories.mageia.org/MGASA-2016-0033.html
URL:advisories.mageia.org/MGASA-2016-0034.html
8. Security Updates in Red Hat Enterprise Linux
(RHSA-2016:0053-1, RHSA-2016:0054-1, RHSA-2016:0055-1, RHSA-2016:0056-1,
RHSA-2016:0057-1, RHSA-2016:0061-1)
[22/01/2016] Red Hat
has released security update packages for fixing the vulnerabilities identified
in the java-1.7.0-openjdk, java-1.8.0-oracle, java-1.7.0-oracle, java-1.6.0-sun,
httpd and httpd22 packages for Red Hat Enterprise Linux 5, 6 and 7, Red Hat
JBoss Web Server 2.1.0 for Red Hat Enterprise Linux 5, 6, and 7. Due to multiple
errors, an attacker could bypass security restrictions, obtain sensitive
information, gain elevated privileges, execute arbitrary code, cause a denial of
service condition and compromise the
system.
URL:rhn.redhat.com/errata/RHSA-2016-0053.html
URL:rhn.redhat.com/errata/RHSA-2016-0054.html
URL:rhn.redhat.com/errata/RHSA-2016-0055.html
URL:rhn.redhat.com/errata/RHSA-2016-0056.html
URL:rhn.redhat.com/errata/RHSA-2016-0057.html
URL:rhn.redhat.com/errata/RHSA-2016-0061.html
9. Security Updates in Ubuntu GNU/Linux (USN-2878-1,
USN-2879-1)
[22/01/2016] Ubuntu has
released security update packages for fixing the vulnerabilities identified in
the perl and rsync packages for versions 12.04 LTS, 14.04 LTS, 15.04 and 15.10.
Due to multiple errors, an attacker could bypass security restrictions and
obtain sensitive
information.
URL:www.ubuntu.com/usn/usn-2878-1/
URL:www.ubuntu.com/usn/usn-2879-1/
10.
Vulnerabilities in Cisco Products
(cisco-sa-20160120-d9036, cisco-sa-20160120-ucsm)
[21/01/2016] Vulnerability was identified in the Cisco Modular Encoding
Platform D9036 Software, Cisco Unified Computing System (UCS) Manager and the
Cisco Firepower 9000 Series appliance. An attacker could bypass security
restrictions, obtain sensitive information, gain elevated privileges, execute
arbitrary code, cause a denial of service condition and compromise the system.
These vulnerabilities affect multiple versions of the mentioned products.
Security patches are available to resolve these
vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160120-d9036
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160120-ucsm
URL:www.hkcert.org/my_url/en/alert/16012102
URL:www.us-cert.gov/ncas/current-activity/2016/01/20/Cisco-Releases-Security-Updates
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109741
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109742
11.
Vulnerability in BlueControl
(109710)
[21/01/2016]
Vulnerability was identified in the BlueControl.
An attacker could bypass security restrictions, execute arbitrary code and
compromise the system. This vulnerability affects version 3.5.SR5 of the
mentioned
product.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109710
12.
Vulnerability in Intel Driver Update
Utility (109706)
[21/01/2016] Vulnerability was identified in the Intel Driver Update
Utility. An attacker could bypass security restrictions and obtain sensitive
information. This vulnerability affects versions prior to 3 of the mentioned
product. Security patches are available to resolve this
vulnerability.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109706
13.
Vulnerability in Panda Security installer
(109732)
[21/01/2016]
Vulnerability was identified in the Panda
Security installer. An attacker could bypass security restrictions, execute
arbitrary code and compromise the system. This vulnerability affects version
2016 of the mentioned
product.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109732
14.
Vulnerabilities in Xen (XSA-167,
XSA-168)
[21/01/2016]
Vulnerabilities were identified in the Xen. An
attacker could bypass security restrictions, obtain sensitive information,
execute arbitrary code, cause a denial of service condition and crash the
system. These vulnerabilities affect multiple versions of the mentioned product.
Security patches are available to resolve these
vulnerabilities.
URL:xenbits.xen.org/xsa/advisory-167.html
URL:xenbits.xen.org/xsa/advisory-168.html
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109739
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109740
15.
Security Updates in Oracle Linux
(ELSA-2016-0045, ELSA-2016-0045-1, ELSA-2016-0049, ELSA-2016-0050,
ELSA-2016-3509, ELSA-2016-3510)
[21/01/2016] Oracle has
released security update packages for fixing the vulnerabilities identified in
the kernel, java-1.8.0-openjdk and kernel-uek packages for Oracle Linux 5, 6 and
7. Due to multiple errors, an attacker could bypass security restrictions,
obtain sensitive information, gain elevated privileges, execute arbitrary code,
cause a denial of service condition and compromise the
system.
URL:linux.oracle.com/errata/ELSA-2016-0045.html
URL:linux.oracle.com/errata/ELSA-2016-0045-1.html
URL:linux.oracle.com/errata/ELSA-2016-0049.html
URL:linux.oracle.com/errata/ELSA-2016-0050.html
URL:linux.oracle.com/errata/ELSA-2016-3509.html
URL:linux.oracle.com/errata/ELSA-2016-3510.html
16.
Security Updates in Debian
(DSA-3450-1)
[21/01/2016] Debian has
released security update packages for fixing the vulnerability identified in the
ecryptfs-utils packages for multiple versions of Debian GNU/Linux. Due to
multiple errors, an attacker could bypass security restrictions and gain
elevated
privileges.
URL:www.debian.org/security/2016/dsa-3450
17.
Security Updates in Red Hat Enterprise
Linux (RHSA-2016:0049-1, RHSA-2016:0050-1)
[21/01/2016] Red Hat
has released security update packages for fixing the vulnerabilities identified
in the java-1.8.0-openjdk packages for Red Hat Enterprise Linux 6 and 7. Due to
multiple errors, an attacker could bypass security restrictions, obtain
sensitive information, gain elevated privileges, execute arbitrary code, cause a
denial of service condition and compromise the
system.
URL:rhn.redhat.com/errata/RHSA-2016-0049.html
URL:rhn.redhat.com/errata/RHSA-2016-0050.html
18.
Security Updates in SUSE
(SUSE-SU-2016:0180-1, SUSE-SU-2016:0186-1)
[21/01/2016] SUSE has
released security update packages for fixing the vulnerabilities identified in
the bind and kernel packages of SUSE Linux Enterprise 12. Due to multiple
errors, an attacker could bypass security restrictions, obtain sensitive
information, gain elevated privileges, execute arbitrary code, cause a denial of
service condition and compromise the
system.
URL:lists.opensuse.org/opensuse-security-announce/2016-01/msg00020.html
URL:lists.opensuse.org/opensuse-security-announce/2016-01/msg00021.html
19.
Security Updates in Ubuntu GNU/Linux
(USN-2876-1)
[21/01/2016] Ubuntu has
released security update packages for fixing the vulnerability identified in the
ecryptfs-utils packages for versions 12.04 LTS, 14.04 LTS, 15.04 and 15.10. An
attacker could bypass security restrictions and gain elevated
privileges.
URL:www.ubuntu.com/usn/usn-2876-1/
20.
Vulnerabilities in ISC BIND9 (AA-01335,
AA-01336)
[20/01/2016]
Vulnerabilities were identified in the ISC
BIND9. An attacker could bypass security restrictions, cause a denial of service
condition and crash the system. These vulnerabilities affect versions prior to
9.9.8-P3, 9.9.8-S4 or 9.10.3-P3 of the mentioned product. Security patches are
available to resolve these
vulnerabilities.
URL:kb.isc.org/article/AA-01335
URL:kb.isc.org/article/AA-01336
URL:www.hkcert.org/my_url/en/alert/16012002
21.
Security Updates in Oracle
Products
[20/01/2016]
Oracle has released security update packages for
fixing the vulnerabilities identified in Oracle Java SE and multiple Oracle
Products. Due to multiple errors, an attacker could bypass security
restrictions, obtain sensitive information, gain elevated privileges, execute
arbitrary code, cause a denial of service condition and compromise the system.
Security patches are available to resolve these
vulnerabilities.
URL:www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html
URL:www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
URL:www.hkcert.org/my_url/en/alert/16012001
URL:www.us-cert.gov/ncas/current-activity/2016/01/19/Oracle-Releases-Security-Bulletin
22.
Vulnerabilities in Apple Products
(HT205730, HT205731, HT205732)
[20/01/2016] Vulnerabilities were identified in the Apple Safari, OS X El
Capitan and iOS. An attacker could bypass security restrictions, obtain
sensitive information, gain elevated privileges, execute arbitrary code, cause a
denial of service condition and compromise the system. These vulnerabilities
affect multiple versions of the mentioned products. Security patches are
available to resolve these
vulnerabilities.
URL:support.apple.com/en-hk/HT205730
URL:support.apple.com/en-hk/HT205731
URL:support.apple.com/en-hk/HT205732
URL:prod.lists.apple.com/archives/security-announce/2016/Jan/msg00002.html
URL:prod.lists.apple.com/archives/security-announce/2016/Jan/msg00003.html
URL:prod.lists.apple.com/archives/security-announce/2016/Jan/msg00004.html
23.
Vulnerability in Cisco Web Security
Appliance (cisco-sa-20160119-wsa)
[20/01/2016] Vulnerability was identified in the Cisco Web Security
Appliance (WSA). An attacker could bypass security restrictions. This
vulnerability affects versions 8.5.3-055, 9.1.0-000 and 9.5.0-235 of the
mentioned product. Security patches are available to resolve this
vulnerability.
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160119-wsa
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109697
24.
Vulnerability in Pivotal Cloud Foundry
(109694)
[20/01/2016]
Vulnerability was identified in the Pivotal
Cloud Foundry. An attacker could bypass security restrictions and obtain
sensitive information. This vulnerability affects versions prior to 1.5.11 or
1.6.11 of the mentioned product. Security patches are available to resolve this
vulnerability.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109694
25.
Vulnerability in Linux Kernel
(109695)
[20/01/2016]
Vulnerability was identified in the Linux
Kernel. An attacker could bypass security restrictions, gain elevated
privileges, execute arbitrary code, cause a denial of service condition and
compromise the system. This vulnerability affects versions 3.8, 3.9 rc1 and
4.0.5 of the mentioned product. Security patches are available to resolve this
vulnerability.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109695
26.
Vulnerability in OpenStack Heat
(109698)
[20/01/2016]
Vulnerability was identified in the OpenStack
Heat. An attacker could bypass security restrictions, execute arbitrary code,
cause a denial of service condition and crash the system. This vulnerability
affects version 2015.1.2 of the mentioned product. Security patches are
available to resolve this
vulnerability.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109698
27.
Security Updates in Debian (DSA-3448-1,
DSA-3449-1)
[20/01/2016] Debian has
released security update packages for fixing the vulnerabilities identified in
the linux and bind9 packages for multiple versions of Debian GNU/Linux. Due to
multiple errors, an attacker could bypass security restrictions, obtain
sensitive information, gain elevated privileges, execute arbitrary code, cause a
denial of service condition and compromise the
system.
URL:www.debian.org/security/2016/dsa-3448
URL:www.debian.org/security/2016/dsa-3449
28.
Security Updates in Red Hat Enterprise
Linux (RHSA-2016:0045-1, RHSA-2016:0046-1)
[20/01/2016] Red Hat
has released security update packages for fixing the vulnerabilities identified
in the kernel packages for Red Hat Enterprise Linux 5 and 6. Due to multiple
errors, an attacker could bypass security restrictions, execute arbitrary code,
cause a denial of service condition and crash the
system.
URL:rhn.redhat.com/errata/RHSA-2016-0045.html
URL:rhn.redhat.com/errata/RHSA-2016-0046.html
29.
Security Updates in SUSE
(SUSE-SU-2016:0164-1, SUSE-SU-2016:0168-1,
SUSE-SU-2016:0174-1)
[20/01/2016] SUSE has
released security update packages for fixing the vulnerabilities identified in
the samba, kernel and bind packages of SUSE Linux Enterprise 11 and 12. Due to
multiple errors, an attacker could bypass security restrictions, obtain
sensitive information, gain elevated privileges, execute arbitrary code, cause a
denial of service condition and compromise the
system.
URL:lists.opensuse.org/opensuse-security-announce/2016-01/msg00017.html
URL:lists.opensuse.org/opensuse-security-announce/2016-01/msg00018.html
URL:lists.opensuse.org/opensuse-security-announce/2016-01/msg00019.html
30.
Security Updates in Ubuntu GNU/Linux
(USN-2870-1, USN-2870-2, USN-2871-1, USN-2871-2, USN-2872-1, USN-2872-3,
USN-2873-1, USN-2874-1, USN-2875-1)
[20/01/2016] Ubuntu has
released security update packages for fixing the vulnerabilities identified in
the linux, linux-lts-trusty, linux-lts-vivid, linux-lts-wily, linux-raspi2,
linux-lts-utopic, bind9 and libxml2 packages for versions 12.04 LTS, 14.04 LTS,
15.04 and 15.10. Due to multiple errors, an attacker could bypass security
restrictions, obtain sensitive information, gain elevated privileges, execute
arbitrary code, cause a denial of service condition and compromise the
system.
URL:www.ubuntu.com/usn/usn-2870-1/
URL:www.ubuntu.com/usn/usn-2870-2/
URL:www.ubuntu.com/usn/usn-2871-1/
URL:www.ubuntu.com/usn/usn-2871-2/
URL:www.ubuntu.com/usn/usn-2872-1/
URL:www.ubuntu.com/usn/usn-2872-2/
URL:www.ubuntu.com/usn/usn-2872-3/
URL:www.ubuntu.com/usn/usn-2873-1/
URL:www.ubuntu.com/usn/usn-2874-1/
URL:www.ubuntu.com/usn/usn-2875-1/
31.
Vulnerability in SevOne NMS
(109659)
[19/01/2016]
Vulnerability was identified in the SevOne NMS.
An attacker could bypass security restrictions and execute arbitrary code on the
system. This vulnerability affects version 5.3.6.0 of the mentioned
product.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109659
32.
Vulnerability in Seeds acmailer
(109653)
[19/01/2016]
Vulnerability was identified in the Seeds
acmailer. An attacker could execute arbitrary code on the system. This
vulnerability affects multiple versions of the mentioned product. Security
patches are available to resolve this
vulnerability.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109653
33.
Vulnerabilities in Cisco Products
(cisco-sa-20160115-FireSIGHT, cisco-sa-20160115-fmc1,
cisco-sa-20160115-asa)
[18/01/2016] Vulnerabilities were identified in the Cisco FireSIGHT
Management Center and Cisco Adaptive Security Appliance (ASA). An attacker could
bypass security restrictions, obtain sensitive information, execute arbitrary
code and perform cross-site scripting attacks. These vulnerabilities affect
multiple firmware versions of the mentioned products. Security patches are
available to resolve these
vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160115-FireSIGHT
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160115-fmc1
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160115-asa
URL:exchange.xforce.ibmcloud.com/vulnerabilities/109648
34.
Vulnerabilities in IBM Products (1973985,
1974157)
[18/01/2016]
Vulnerabilities were identified in the IBM
Rational Host On-Demand and IBM Tivoli Federated Identity Manager. An attacker
could bypass security restrictions, obtain sensitive information, execute
arbitrary code and perform cross-site scripting attacks. These vulnerabilities
affect multiple versions of the mentioned products. Security patches are
available to resolve these
vulnerabilities.
URL:www-01.ibm.com/support/docview.wss?uid=swg21973985
URL:www-01.ibm.com/support/docview.wss?uid=swg21974157
URL:exchange.xforce.ibmcloud.com/vulnerabilities/105255
URL:exchange.xforce.ibmcloud.com/vulnerabilities/106216
35.
Security Updates in Debian
(DSA-3447-1)
[18/01/2016] Debian has
released security update packages for fixing the vulnerability identified in the
tomcat7 packages for multiple versions of Debian GNU/Linux. An attacker could
bypass security restrictions, obtain sensitive information, gain elevated
privileges, execute arbitrary code, cause a denial of service condition and
compromise the
system.
URL:www.debian.org/security/2016/dsa-3447
36.
Security Updates in FreeBSD
(FreeBSD-SA-16:07.openssh)
[18/01/2016] FreeBSD
has released security update packages for fixing the vulnerability identified in
the openssh packages for multiple versions of FreeBSD Linux. An attacker could
bypass security restrictions, obtain sensitive information, gain elevated
privileges, execute arbitrary code, cause a denial of service condition and
compromise the
system.
URL:www.freebsd.org/security/advisories/FreeBSD-SA-16:07.openssh.asc
37.
Security Updates in Gentoo Linux (GLSA
201601-01)
[18/01/2016]
Gentoo has released security update packages for
fixing the vulnerability identified in the openssh packages for multiple
versions of Gentoo Linux. An attacker could bypass security restrictions, obtain
sensitive information, gain elevated privileges, execute arbitrary code, cause a
denial of service condition and compromise the
system.
URL:security.gentoo.org/glsa/201601-01
38.
Security Updates in Mageia
(MGASA-2016-0022, MGASA-2016-0023, MGASA-2016-0024)
[18/01/2016] Mageia has released security update packages for fixing the
vulnerability identified in the openssh, qemu and php packages for multiple
versions of Mageia. Due to multiple errors, an attacker could bypass security
restrictions, obtain sensitive information, gain elevated privileges, execute
arbitrary code, cause a denial of service condition and compromise the
system.
URL:advisories.mageia.org/MGASA-2016-0022.html
URL:advisories.mageia.org/MGASA-2016-0023.html
URL:advisories.mageia.org/MGASA-2016-0024.html
39.
Security Updates in SUSE
(openSUSE-SU-2016:0144-1, openSUSE-SU-2016:0145-1)
[18/01/2016] SUSE has released security update packages for fixing the
vulnerabilities identified in the openssh packages of openSUSE Evergreen 11.4
and openSUSE 13.1. Due to multiple errors, an attacker could bypass security
restrictions, obtain sensitive information, gain elevated privileges, execute
arbitrary code, cause a denial of service condition and compromise the
system.
URL:lists.opensuse.org/opensuse-security-announce/2016-01/msg00015.html
URL:lists.opensuse.org/opensuse-security-announce/2016-01/msg00016.html
40.
Security Updates in Slackware
(SSA:2016-014-01)
[18/01/2016] Slackware
has released security update packages for fixing the vulnerability identified in
the openssh packages for multiple versions of Slackware Linux. An attacker could
bypass security restrictions, obtain sensitive information, gain elevated
privileges, execute arbitrary code, cause a denial of service condition and
compromise the
system.
URL:www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.677958
Showing posts with label Google. Show all posts
Showing posts with label Google. Show all posts
Sunday, January 24, 2016
Sunday, December 6, 2015
IT Security Alerts Weekly Digest (29 Nov ~ 5 Dec 2015)
1. Vulnerabilities in F5 Products (SOL05770600, SOL51841514,
SOL90230486)
[04/12/2015] Vulnerabilities were identified in the F5 BIG-IP LTM, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM, BIG-IP ASM, BIG-IP DNS, BIG-IP Edge Gateway, BIG-IP GTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IP PSM, BIG-IP WebAccelerator, BIG-IP WOM, Enterprise Manager, BIG-IQ Cloud, BIG-IQ Device, BIG-IQ Security, BIG-IQ ADC and Traffix SDC. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:support.f5.com/kb/en-us/solutions/public/k/05/sol05770600.html
URL:support.f5.com/kb/en-us/solutions/public/k/51/sol51841514.html
URL:support.f5.com/kb/en-us/solutions/public/k/90/sol90230486.html
2. Vulnerabilities in Huawei Wimax routers (HW-464086)
[04/12/2015] Vulnerabilities were identified in the Huawei Wimax routers. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products.
URL:www.huawei.com/en/security/psirt/security-bulletins/security-notices/archive/hw-464086.htm
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108438
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108440
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108441
3. Vulnerabilities in Honeywell Midas gas detector (ICSA-15-309-02)
[04/12/2015] Vulnerabilities were identified in the Honeywell Midas gas detector. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:ics-cert.us-cert.gov/advisories/ICSA-15-309-02
4. Vulnerabilities in SearchBlox (ICSA-15-337-01)
[04/12/2015] Vulnerabilities were identified in the SearchBlox. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect versions prior to 8.3.1 of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:ics-cert.us-cert.gov/advisories/ICSA-15-337-01
5. Vulnerabilities in OpenSSL
[04/12/2015] Vulnerabilities were identified in the OpenSSL. An attacker could bypass security restrictions, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:www.openssl.org/news/secadv/20151203.txt
URL:www.us-cert.gov/ncas/current-activity/2015/12/03/OpenSSL-Patches-Multiple-Vulnerabilities
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108502
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108503
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108504
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108505
6. Vulnerabilities in Drupal (DRUPAL-SA-CONTRIB-2015-167, DRUPAL-SA-CONTRIB-2015-168, DRUPAL-SA-CONTRIB-2015-169, DRUPAL-SA-CONTRIB-2015-171)
[04/12/2015] Vulnerabilities were identified in the RESTful, Mollom, Chat Room and Token Insert Entity modules for Drupal. An attacker could bypass security restrictions and obtain sensitive information. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:www.drupal.org/node/2627444
URL:www.drupal.org/node/2627448
URL:www.drupal.org/node/2627478
URL:www.drupal.org/node/2627638
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108491
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108492
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108493
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108494
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108495
7. Security Updates in Debian (DSA-3411-1)
[04/12/2015] Debian has released security update packages for fixing the vulnerability identified in the cups-filters packages for multiple versions of Debian GNU/Linux. An attacker could bypass security restrictions and execute arbitrary code on the system.
URL:www.debian.org/security/2015/dsa-3411
8. Security Updates in Red Hat Enterprise Linux (RHSA-2015:2545-1)
[04/12/2015] Red Hat has released security update packages for fixing the vulnerabilities identified in the chromium-browser packages for Red Hat Enterprise Linux 6. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:rhn.redhat.com/errata/RHSA-2015-2545.html
9. Security Updates in Slackware (SSA:2015-337-01, SSA:2015-337-02)
[04/12/2015] Slackware has released security update packages for fixing the vulnerabilities identified in the libpng and mozilla-thunderbird packages for multiple versions of Slackware Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.522940
URL:www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.359041
10. Security Updates in Ubuntu GNU/Linux (USN-2826-1, USN-2827-1, USN-2828-1)
[04/12/2015] Ubuntu has released security update packages for fixing the vulnerabilities identified in the linux-lts-trusty, openjdk-6, qemu and qemu-kvm packages for versions 12.04 LTS, 14.04 LTS, 15.04 and Ubuntu 15.10. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:www.ubuntu.com/usn/usn-2826-1/
URL:www.ubuntu.com/usn/usn-2827-1/
URL:www.ubuntu.com/usn/usn-2828-1/
11. Vulnerabilities in Cisco Products (cisco-sa-20151202-pca, cisco-sa-20151202-sip)
[03/12/2015] Vulnerabilities were identified in the Cisco Unity Connection and Cisco Unified SIP Phone 3905. An attacker could bypass security restrictions, execute arbitrary code, perform cross-site Scripting, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151202-pca
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151202-sip
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108447
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108449
12. Vulnerabilities in Huawei LogCenter (Huawei-SA-20151202-01-LogCenter, Huawei-SA-20151202-02-LogCenter)
[03/12/2015] Vulnerabilities were identified in the Huawei LogCenter. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect versions prior to V100R001C10SPC300B018 of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:www.huawei.com/en/security/psirt/security-bulletins/security-advisories/archive/hw-464243.htm
URL:www.huawei.com/en/security/psirt/security-bulletins/security-advisories/archive/hw-464247.htm
13. Vulnerabilities in ABRT (108426, 108437)
[03/12/2015] Vulnerabilities were identified in the ABRT. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system. These vulnerabilities affect version 2.0.6 of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108426
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108437
14. Security Updates in Debian (DSA-3409-1, DSA-3410-1)
[03/12/2015] Debian has released security update packages for fixing the vulnerabilities identified in the putty and icedove packages for multiple versions of Debian GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:www.debian.org/security/2015/dsa-3409
URL:www.debian.org/security/2015/dsa-3410
15. Security Updates in Red Hat Enterprise Linux (RHSA-2015:2538-1, RHSA-2015:2539-1, RHSA-2015:2542-1)
[03/12/2015] Red Hat has released security update packages for fixing the vulnerabilities identified in the Red Hat JBoss Enterprise Application Platform packages for Red Hat Enterprise Linux 5 and 6. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:rhn.redhat.com/errata/RHSA-2015-2538.html
URL:rhn.redhat.com/errata/RHSA-2015-2539.html
URL:rhn.redhat.com/errata/RHSA-2015-2542.html
16. Security Updates in SUSE (SUSE-SU-2015:2166-1, SUSE-SU-2015:2168-1, SUSE-SU-2015:2174-1)
[03/12/2015] SUSE has released security update packages for fixing the vulnerabilities identified in the java-1_6_0-ibm, java-1_7_1-ibm and dhcpcd packages of SUSE Linux Enterprise 11 and 12. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html
URL:lists.opensuse.org/opensuse-security-announce/2015-12/msg00001.html
URL:lists.opensuse.org/opensuse-security-announce/2015-12/msg00002.html
17. Vulnerabilities in IBM Notes and Domino (1971361)
[02/12/2015] Vulnerabilities were identified in the IBM Notes and Domino. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:www.ibm.com/support/docview.wss?uid=swg21971361
18. Vulnerabilities in Cisco Products (cisco-sa-20151201-ucs, cisco-sa-20151201-ucs1, cisco-sa-20151201-wmc)
[02/12/2015] Vulnerabilities were identified in the Cisco Unified Computing System (UCS) Central Software and Cisco WebEx Meetings for Android. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code, perform cross-site Scripting and server-side request forgery (SSRF) attacks . These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-ucs
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-ucs1
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-wmc
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108401
19. Vulnerabilities in Belkin N150 Wireless Home Router (108388, 108389, 108390, 108391)
[02/12/2015] Vulnerabilities were identified in the Belkin N150 Wireless Home Router. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system. The affected version was not specified.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108388
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108389
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108390
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108391
20. Vulnerability in Saia Burgess Controls PCD Controller (ICSA-15-335-01)
[02/12/2015] Vulnerability was identified in multiple Saia Burgess Controls PCD Controllers. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system. This vulnerability affects multiple firmware versions of the mentioned products. Security patches are available to resolve this vulnerability.
URL:ics-cert.us-cert.gov/advisories/ICSA-15-335-01
21. Vulnerability in Siemens SIMATIC Communication Processor devices (ICSA-15-335-03)
[02/12/2015] Vulnerability was identified in multiple Siemens SIMATIC Communication Processor devices. An attacker could bypass security restrictions, gain elevated privileges, execute arbitrary code and compromise the system. This vulnerability affects multiple firmware versions of the mentioned products. Security patches are available to resolve this vulnerability.
URL:ics-cert.us-cert.gov/advisories/ICSA-15-335-03
22. Vulnerabilities in Google Chrome
[02/12/2015] Vulnerabilities were identified in the Google Chrome. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect versions prior to 47.0.2526.73 of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:googlechromereleases.blogspot.hk/2015/12/stable-channel-update.html
URL:www.us-cert.gov/ncas/current-activity/2015/12/01/Google-Releases-Security-Update-Chrome
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108403
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108404
23. Security Updates in Debian (DSA-3408-1)
[02/12/2015] Debian has released security update packages for fixing the vulnerability identified in the gnutls26 packages for multiple versions of Debian GNU/Linux. An attacker could bypass security restrictions, execute arbitrary code, cause a denial of service condition and crash the system.
URL:www.debian.org/security/2015/dsa-3408
24. Security Updates in Ubuntu GNU/Linux (USN-2819-1, USN-2823-1, USN-2824-1)
[02/12/2015] Ubuntu has released security update packages for fixing the vulnerabilities identified in the thunderbird, linux and linux-lts-utopic packages for versions 12.04 LTS, 14.04 LTS, 15.04 and Ubuntu 15.10. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:www.ubuntu.com/usn/usn-2819-1/
URL:www.ubuntu.com/usn/usn-2823-1/
URL:www.ubuntu.com/usn/usn-2824-1/
25. Security Update in Microsoft Products (3119884)
[01/12/2015] Microsoft has released security updates for all support releases of Microsoft Windows to remove the trust of the unconstrained digital certificates from Dell. An attacker could make use of these certificates to spoof content, perform phishing attacks and perform man-in-the-middle attacks against Dell customers.
URL:technet.microsoft.com/library/security/3119884.aspx
26. Vulnerabilities in Cisco Products (cisco-sa-20151130-asa, cisco-sa-20151130-csr, isco-sa-20151130-wsa)
[01/12/2015] Vulnerabilities were identified in the Cisco Aggregation Services Routers (ASR) 1000 Series, Cisco Cloud Services Router 1000V Series and Cisco Web Security Appliance (WSA). An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-asa
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-csr
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-wsa
27. Vulnerabilities in Node.js (108360, 108361)
[01/12/2015] Vulnerabilities were identified in the Node.js. An attacker could bypass security restrictions, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108360
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108361
28. Vulnerabilities in Qemu (108331, 108362)
[01/12/2015] Vulnerabilities were identified in the Qemu. An attacker could bypass security restrictions, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108331
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108362
29. Vulnerability in Xen (XSA-162)
[01/12/2015] Vulnerability was identified in the Xen. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code, cause a denial of service condition and crash the system. This vulnerability affects multiple versions of the mentioned product. Security patches are available to resolve this vulnerability.
URL:xenbits.xen.org/xsa/advisory-162.html
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108358
30. Security Updates in Oracle Linux (ELSA-2015-2521, ELSA-2015-2522)
[01/12/2015] Oracle has released security update packages for fixing the vulnerability identified in the jakarta-commons-collections and apache-commons-collections packages for Oracle Linux 6 and 7. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges and execute arbitrary code on the system.
URL:linux.oracle.com/errata/ELSA-2015-2521.html
URL:linux.oracle.com/errata/ELSA-2015-2522.html
31. Security Updates in Red Hat Enterprise Linux (RHSA-2015:2521-1, RHSA-2015:2522-1, RHSA-2015:2523-1)
[01/12/2015] Red Hat has released security update packages for fixing the vulnerability identified in the jakarta-commons-collections, apache-commons-collections and rh-java-common-apache-commons-collections packages for Red Hat Enterprise Linux 6 and 7, and Red Hat Software Collections 2. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges and execute arbitrary code on the system.
URL:rhn.redhat.com/errata/RHSA-2015-2521.html
URL:rhn.redhat.com/errata/RHSA-2015-2522.html
URL:rhn.redhat.com/errata/RHSA-2015-2523.html
32. Security Updates in Ubuntu GNU/Linux (USN-2821-1)
[01/12/2015] Ubuntu has released security update packages for fixing the vulnerability identified in the gnutls26 packages for versions 12.04 LTS and 14.04 LTS. An attacker could bypass security restrictions, execute arbitrary code and perform a padding oracle attack.
URL:www.ubuntu.com/usn/usn-2821-1/
33. Security Updates in Oracle Linux (ELSA-2015-2519, ELSA-2015-3101)
[30/11/2015] Oracle has released security update packages for fixing the vulnerabilities identified in the thunderbird and kernel packages for Oracle Linux 5, 6 and 7. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system.
URL:linux.oracle.com/errata/ELSA-2015-2519.html
URL:linux.oracle.com/errata/ELSA-2015-3101.html
34. Security Updates in Mageia (MGASA-2015-0460, MGASA-2015-0461, MGASA-2015-0462)
[30/11/2015] Mageia has released security update packages for fixing the vulnerabilities identified in the python-cryptography, python-cryptography-vectors, python-pyasn1, python-idna, python-ipaddress, python-cffi, lightdm, thunderbird and thunderbird-l10n packages for multiple versions of Mageia. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:advisories.mageia.org/MGASA-2015-0460.html
URL:advisories.mageia.org/MGASA-2015-0461.html
URL:advisories.mageia.org/MGASA-2015-0462.html
Malware Alert
1. Dorkbot
[04/12/2015] Dorkbot is a botnet used to steal sensitive information, launch distributed denial-of-service (DDoS) attacks and drop other types of malware on the compromised computers. It propagates through infected USB flash drives and malicious links sent via instant messaging programs and social networks.
A system infected with Dorkbot may be used to send spam, participate in DDoS attacks and harvest users' credentials for online services including banking services.
This malware runs on Microsoft Windows 95, 98, Me, NT, 2000, XP, Vista, 7, Windows Server 2003 and Windows Server 2008. Malware signatures and removal procedures are available from most anti-virus vendors. For more information about this malware, please refer to the following link:
URL:www.us-cert.gov/ncas/alerts/TA15-337A
URL:www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Worm%3AWin32/Dorkbot
URL:www.symantec.com/security_response/writeup.jsp?docid=2011-040711-0927-99
URL:www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_dorkbot
[04/12/2015] Vulnerabilities were identified in the F5 BIG-IP LTM, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM, BIG-IP ASM, BIG-IP DNS, BIG-IP Edge Gateway, BIG-IP GTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IP PSM, BIG-IP WebAccelerator, BIG-IP WOM, Enterprise Manager, BIG-IQ Cloud, BIG-IQ Device, BIG-IQ Security, BIG-IQ ADC and Traffix SDC. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:support.f5.com/kb/en-us/solutions/public/k/05/sol05770600.html
URL:support.f5.com/kb/en-us/solutions/public/k/51/sol51841514.html
URL:support.f5.com/kb/en-us/solutions/public/k/90/sol90230486.html
2. Vulnerabilities in Huawei Wimax routers (HW-464086)
[04/12/2015] Vulnerabilities were identified in the Huawei Wimax routers. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products.
URL:www.huawei.com/en/security/psirt/security-bulletins/security-notices/archive/hw-464086.htm
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108438
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108440
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108441
3. Vulnerabilities in Honeywell Midas gas detector (ICSA-15-309-02)
[04/12/2015] Vulnerabilities were identified in the Honeywell Midas gas detector. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:ics-cert.us-cert.gov/advisories/ICSA-15-309-02
4. Vulnerabilities in SearchBlox (ICSA-15-337-01)
[04/12/2015] Vulnerabilities were identified in the SearchBlox. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect versions prior to 8.3.1 of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:ics-cert.us-cert.gov/advisories/ICSA-15-337-01
5. Vulnerabilities in OpenSSL
[04/12/2015] Vulnerabilities were identified in the OpenSSL. An attacker could bypass security restrictions, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:www.openssl.org/news/secadv/20151203.txt
URL:www.us-cert.gov/ncas/current-activity/2015/12/03/OpenSSL-Patches-Multiple-Vulnerabilities
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108502
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108503
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108504
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108505
6. Vulnerabilities in Drupal (DRUPAL-SA-CONTRIB-2015-167, DRUPAL-SA-CONTRIB-2015-168, DRUPAL-SA-CONTRIB-2015-169, DRUPAL-SA-CONTRIB-2015-171)
[04/12/2015] Vulnerabilities were identified in the RESTful, Mollom, Chat Room and Token Insert Entity modules for Drupal. An attacker could bypass security restrictions and obtain sensitive information. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:www.drupal.org/node/2627444
URL:www.drupal.org/node/2627448
URL:www.drupal.org/node/2627478
URL:www.drupal.org/node/2627638
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108491
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108492
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108493
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108494
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108495
7. Security Updates in Debian (DSA-3411-1)
[04/12/2015] Debian has released security update packages for fixing the vulnerability identified in the cups-filters packages for multiple versions of Debian GNU/Linux. An attacker could bypass security restrictions and execute arbitrary code on the system.
URL:www.debian.org/security/2015/dsa-3411
8. Security Updates in Red Hat Enterprise Linux (RHSA-2015:2545-1)
[04/12/2015] Red Hat has released security update packages for fixing the vulnerabilities identified in the chromium-browser packages for Red Hat Enterprise Linux 6. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:rhn.redhat.com/errata/RHSA-2015-2545.html
9. Security Updates in Slackware (SSA:2015-337-01, SSA:2015-337-02)
[04/12/2015] Slackware has released security update packages for fixing the vulnerabilities identified in the libpng and mozilla-thunderbird packages for multiple versions of Slackware Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.522940
URL:www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.359041
10. Security Updates in Ubuntu GNU/Linux (USN-2826-1, USN-2827-1, USN-2828-1)
[04/12/2015] Ubuntu has released security update packages for fixing the vulnerabilities identified in the linux-lts-trusty, openjdk-6, qemu and qemu-kvm packages for versions 12.04 LTS, 14.04 LTS, 15.04 and Ubuntu 15.10. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:www.ubuntu.com/usn/usn-2826-1/
URL:www.ubuntu.com/usn/usn-2827-1/
URL:www.ubuntu.com/usn/usn-2828-1/
11. Vulnerabilities in Cisco Products (cisco-sa-20151202-pca, cisco-sa-20151202-sip)
[03/12/2015] Vulnerabilities were identified in the Cisco Unity Connection and Cisco Unified SIP Phone 3905. An attacker could bypass security restrictions, execute arbitrary code, perform cross-site Scripting, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151202-pca
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151202-sip
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108447
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108449
12. Vulnerabilities in Huawei LogCenter (Huawei-SA-20151202-01-LogCenter, Huawei-SA-20151202-02-LogCenter)
[03/12/2015] Vulnerabilities were identified in the Huawei LogCenter. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect versions prior to V100R001C10SPC300B018 of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:www.huawei.com/en/security/psirt/security-bulletins/security-advisories/archive/hw-464243.htm
URL:www.huawei.com/en/security/psirt/security-bulletins/security-advisories/archive/hw-464247.htm
13. Vulnerabilities in ABRT (108426, 108437)
[03/12/2015] Vulnerabilities were identified in the ABRT. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system. These vulnerabilities affect version 2.0.6 of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108426
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108437
14. Security Updates in Debian (DSA-3409-1, DSA-3410-1)
[03/12/2015] Debian has released security update packages for fixing the vulnerabilities identified in the putty and icedove packages for multiple versions of Debian GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:www.debian.org/security/2015/dsa-3409
URL:www.debian.org/security/2015/dsa-3410
15. Security Updates in Red Hat Enterprise Linux (RHSA-2015:2538-1, RHSA-2015:2539-1, RHSA-2015:2542-1)
[03/12/2015] Red Hat has released security update packages for fixing the vulnerabilities identified in the Red Hat JBoss Enterprise Application Platform packages for Red Hat Enterprise Linux 5 and 6. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:rhn.redhat.com/errata/RHSA-2015-2538.html
URL:rhn.redhat.com/errata/RHSA-2015-2539.html
URL:rhn.redhat.com/errata/RHSA-2015-2542.html
16. Security Updates in SUSE (SUSE-SU-2015:2166-1, SUSE-SU-2015:2168-1, SUSE-SU-2015:2174-1)
[03/12/2015] SUSE has released security update packages for fixing the vulnerabilities identified in the java-1_6_0-ibm, java-1_7_1-ibm and dhcpcd packages of SUSE Linux Enterprise 11 and 12. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html
URL:lists.opensuse.org/opensuse-security-announce/2015-12/msg00001.html
URL:lists.opensuse.org/opensuse-security-announce/2015-12/msg00002.html
17. Vulnerabilities in IBM Notes and Domino (1971361)
[02/12/2015] Vulnerabilities were identified in the IBM Notes and Domino. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:www.ibm.com/support/docview.wss?uid=swg21971361
18. Vulnerabilities in Cisco Products (cisco-sa-20151201-ucs, cisco-sa-20151201-ucs1, cisco-sa-20151201-wmc)
[02/12/2015] Vulnerabilities were identified in the Cisco Unified Computing System (UCS) Central Software and Cisco WebEx Meetings for Android. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code, perform cross-site Scripting and server-side request forgery (SSRF) attacks . These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-ucs
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-ucs1
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-wmc
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108401
19. Vulnerabilities in Belkin N150 Wireless Home Router (108388, 108389, 108390, 108391)
[02/12/2015] Vulnerabilities were identified in the Belkin N150 Wireless Home Router. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system. The affected version was not specified.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108388
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108389
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108390
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108391
20. Vulnerability in Saia Burgess Controls PCD Controller (ICSA-15-335-01)
[02/12/2015] Vulnerability was identified in multiple Saia Burgess Controls PCD Controllers. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system. This vulnerability affects multiple firmware versions of the mentioned products. Security patches are available to resolve this vulnerability.
URL:ics-cert.us-cert.gov/advisories/ICSA-15-335-01
21. Vulnerability in Siemens SIMATIC Communication Processor devices (ICSA-15-335-03)
[02/12/2015] Vulnerability was identified in multiple Siemens SIMATIC Communication Processor devices. An attacker could bypass security restrictions, gain elevated privileges, execute arbitrary code and compromise the system. This vulnerability affects multiple firmware versions of the mentioned products. Security patches are available to resolve this vulnerability.
URL:ics-cert.us-cert.gov/advisories/ICSA-15-335-03
22. Vulnerabilities in Google Chrome
[02/12/2015] Vulnerabilities were identified in the Google Chrome. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect versions prior to 47.0.2526.73 of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:googlechromereleases.blogspot.hk/2015/12/stable-channel-update.html
URL:www.us-cert.gov/ncas/current-activity/2015/12/01/Google-Releases-Security-Update-Chrome
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108403
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108404
23. Security Updates in Debian (DSA-3408-1)
[02/12/2015] Debian has released security update packages for fixing the vulnerability identified in the gnutls26 packages for multiple versions of Debian GNU/Linux. An attacker could bypass security restrictions, execute arbitrary code, cause a denial of service condition and crash the system.
URL:www.debian.org/security/2015/dsa-3408
24. Security Updates in Ubuntu GNU/Linux (USN-2819-1, USN-2823-1, USN-2824-1)
[02/12/2015] Ubuntu has released security update packages for fixing the vulnerabilities identified in the thunderbird, linux and linux-lts-utopic packages for versions 12.04 LTS, 14.04 LTS, 15.04 and Ubuntu 15.10. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:www.ubuntu.com/usn/usn-2819-1/
URL:www.ubuntu.com/usn/usn-2823-1/
URL:www.ubuntu.com/usn/usn-2824-1/
25. Security Update in Microsoft Products (3119884)
[01/12/2015] Microsoft has released security updates for all support releases of Microsoft Windows to remove the trust of the unconstrained digital certificates from Dell. An attacker could make use of these certificates to spoof content, perform phishing attacks and perform man-in-the-middle attacks against Dell customers.
URL:technet.microsoft.com/library/security/3119884.aspx
26. Vulnerabilities in Cisco Products (cisco-sa-20151130-asa, cisco-sa-20151130-csr, isco-sa-20151130-wsa)
[01/12/2015] Vulnerabilities were identified in the Cisco Aggregation Services Routers (ASR) 1000 Series, Cisco Cloud Services Router 1000V Series and Cisco Web Security Appliance (WSA). An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-asa
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-csr
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-wsa
27. Vulnerabilities in Node.js (108360, 108361)
[01/12/2015] Vulnerabilities were identified in the Node.js. An attacker could bypass security restrictions, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108360
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108361
28. Vulnerabilities in Qemu (108331, 108362)
[01/12/2015] Vulnerabilities were identified in the Qemu. An attacker could bypass security restrictions, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108331
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108362
29. Vulnerability in Xen (XSA-162)
[01/12/2015] Vulnerability was identified in the Xen. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code, cause a denial of service condition and crash the system. This vulnerability affects multiple versions of the mentioned product. Security patches are available to resolve this vulnerability.
URL:xenbits.xen.org/xsa/advisory-162.html
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108358
30. Security Updates in Oracle Linux (ELSA-2015-2521, ELSA-2015-2522)
[01/12/2015] Oracle has released security update packages for fixing the vulnerability identified in the jakarta-commons-collections and apache-commons-collections packages for Oracle Linux 6 and 7. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges and execute arbitrary code on the system.
URL:linux.oracle.com/errata/ELSA-2015-2521.html
URL:linux.oracle.com/errata/ELSA-2015-2522.html
31. Security Updates in Red Hat Enterprise Linux (RHSA-2015:2521-1, RHSA-2015:2522-1, RHSA-2015:2523-1)
[01/12/2015] Red Hat has released security update packages for fixing the vulnerability identified in the jakarta-commons-collections, apache-commons-collections and rh-java-common-apache-commons-collections packages for Red Hat Enterprise Linux 6 and 7, and Red Hat Software Collections 2. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges and execute arbitrary code on the system.
URL:rhn.redhat.com/errata/RHSA-2015-2521.html
URL:rhn.redhat.com/errata/RHSA-2015-2522.html
URL:rhn.redhat.com/errata/RHSA-2015-2523.html
32. Security Updates in Ubuntu GNU/Linux (USN-2821-1)
[01/12/2015] Ubuntu has released security update packages for fixing the vulnerability identified in the gnutls26 packages for versions 12.04 LTS and 14.04 LTS. An attacker could bypass security restrictions, execute arbitrary code and perform a padding oracle attack.
URL:www.ubuntu.com/usn/usn-2821-1/
33. Security Updates in Oracle Linux (ELSA-2015-2519, ELSA-2015-3101)
[30/11/2015] Oracle has released security update packages for fixing the vulnerabilities identified in the thunderbird and kernel packages for Oracle Linux 5, 6 and 7. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system.
URL:linux.oracle.com/errata/ELSA-2015-2519.html
URL:linux.oracle.com/errata/ELSA-2015-3101.html
34. Security Updates in Mageia (MGASA-2015-0460, MGASA-2015-0461, MGASA-2015-0462)
[30/11/2015] Mageia has released security update packages for fixing the vulnerabilities identified in the python-cryptography, python-cryptography-vectors, python-pyasn1, python-idna, python-ipaddress, python-cffi, lightdm, thunderbird and thunderbird-l10n packages for multiple versions of Mageia. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.
URL:advisories.mageia.org/MGASA-2015-0460.html
URL:advisories.mageia.org/MGASA-2015-0461.html
URL:advisories.mageia.org/MGASA-2015-0462.html
Malware Alert
1. Dorkbot
[04/12/2015] Dorkbot is a botnet used to steal sensitive information, launch distributed denial-of-service (DDoS) attacks and drop other types of malware on the compromised computers. It propagates through infected USB flash drives and malicious links sent via instant messaging programs and social networks.
A system infected with Dorkbot may be used to send spam, participate in DDoS attacks and harvest users' credentials for online services including banking services.
This malware runs on Microsoft Windows 95, 98, Me, NT, 2000, XP, Vista, 7, Windows Server 2003 and Windows Server 2008. Malware signatures and removal procedures are available from most anti-virus vendors. For more information about this malware, please refer to the following link:
URL:www.us-cert.gov/ncas/alerts/TA15-337A
URL:www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Worm%3AWin32/Dorkbot
URL:www.symantec.com/security_response/writeup.jsp?docid=2011-040711-0927-99
URL:www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_dorkbot
Monday, September 1, 2014
IT Security Alerts Weekly Digest (24 Aug ~ 30 Aug 2014)
1. Vulnerability
in Apache HttpComponents
[29/08/2014] Vulnerability was identified in the Apache HttpClient and Apache HttpAsyncClient. An attacker could perform man-in-the-middle attacks. This vulnerability affects versions prior to 4.3.5 of Apache HttpClient, and versions prior to 4.0.2 of Apache HttpAsyncClient. Security patches are available to resolve this vulnerability.
URL:mail-archives.apache.org/mod_mbox/www-announce/201408.mbox/CVE-2014-3577
2. Vulnerabilities in Cisco Cloud Portal
[29/08/2014] Vulnerabilities were identified in the Cisco Cloud Portal. An attacker could obtain sensitive information and execute arbitrary code. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3349
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3350
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3351
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3352
URL:xforce.iss.net/xforce/xfdb/95585
URL:xforce.iss.net/xforce/xfdb/95586
URL:xforce.iss.net/xforce/xfdb/95587
3. Vulnerabilities in IBM Products (1680453, 1680454, 1681277)
[29/08/2014] Vulnerabilities were identified in the IBM Tivoli Storage Manager (TSM) and IBM Emptoris Spend Analysis. An attacker could bypass security restrictions, gain elevated privileges, perform cross-site scripting and phishing attacks. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:www.ibm.com/support/docview.wss?uid=swg21680453
URL:www.ibm.com/support/docview.wss?uid=swg21680454
URL:www.ibm.com/support/docview.wss?uid=swg21681277
4. Vulnerabilities in Django (95564, 95566, 95567, 95569)
[29/08/2014] Vulnerabilities were identified in the Django. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code and cause a denial of service condition. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:xforce.iss.net/xforce/xfdb/95564
URL:xforce.iss.net/xforce/xfdb/95566
URL:xforce.iss.net/xforce/xfdb/95567
URL:xforce.iss.net/xforce/xfdb/95569
5. Vulnerabilities in ManageEngine Products (95562, 95565)
[29/08/2014] Vulnerabilities were identified in the ManageEngine DeviceExpert and ManageEngine EventLog Analyzer. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code and perform cross-site scripting attacks. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve the vulnerability of the EventLog Analyzer.
URL:xforce.iss.net/xforce/xfdb/95562
URL:xforce.iss.net/xforce/xfdb/95565
6. Security Updates in Debian (DSA-3013-1, DSA-3014-1)
[29/08/2014] Debian has released security update packages for fixing the vulnerabilities identified in the s3ql and squid3 packages for multiple versions of Debian GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, execute arbitrary code and cause a denial of service condition.
URL:www.debian.org/security/2014/dsa-3013
URL:www.debian.org/security/2014/dsa-3014
7. Security Updates in SUSE (SUSE-SU-2014:1072-1)
[29/08/2014] SUSE has released security update packages for fixing the vulnerabilities identified in the MySQL packages for SUSE Linux Enterprise 11. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information and execute arbitrary code.
URL:lists.opensuse.org/opensuse-security-announce/2014-08/msg00012.html
8. Security Updates in Ubuntu GNU/Linux (USN-2327-1, USN-2328-1)
[29/08/2014] Ubuntu has released security update packages for fixing the vulnerabilities identified in the squid3 and eglibc packages for versions 10.04 LTS, 12.04 LTS and 14.04 LTS of Ubuntu GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, gain elevated privileges, execute arbitrary code and cause a denial of service condition.
URL:www.ubuntu.com/usn/usn-2327-1/
URL:www.ubuntu.com/usn/usn-2328-1/
9. Information Updates on Microsoft Security Bulletin (MS14-045)
[28/08/2014] Microsoft has updated information on the Security Bulletin for Microsoft Windows. MS14-045 was rereleased to announce the replacement of the 2982791 update with the 2993651 update for all supported releases of Microsoft Windows.
URL:technet.microsoft.com/library/security/ms14-045
10. Vulnerabilities in Cisco Products
[28/08/2014] Vulnerabilities were identified in the Cisco Transport Gateway for Smart Call Home and Cisco 1800 Series Integrated Services Routers. An attacker could bypass security restrictions, execute arbitrary code and cause a denial of service condition. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3345
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3346
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3347
URL:xforce.iss.net/xforce/xfdb/95558
11. Vulnerability in IBM DB2 Accessories Suite (1682096)
[28/08/2014] Vulnerability was identified in the IBM DB2 Accessories Suite. An attacker could cause a denial of service condition and execute arbitrary code. This vulnerability affects versions 10.1 and 10.5 of the mentioned product. Security patches are available to resolve this vulnerability.
URL:www.ibm.com/support/docview.wss?uid=swg21682096
12. Vulnerability in Novell GroupWise (7015566)
[28/08/2014] Vulnerability was identified in the GroupWise 2014 Administration service. An attacker could bypass security restrictions, obtain sensitive information and execute arbitrary code. This vulnerability affects versions prior to Support Pack 1 (SP1) of the mentioned product. Security patches are available to resolve this vulnerability.
URL:www.novell.com/support/kb/doc.php?id=7015566
URL:xforce.iss.net/xforce/xfdb/95557
13. Vulnerabilities in VMware Support Tool (95493, 95494)
[28/08/2014] Vulnerabilities were identified in the VMware Support Tool. An attacker could bypass security restrictions, cause a denial of service condition and crash the system. These vulnerabilities affect version vm-support 0.88 of the mentioned product.
URL:xforce.iss.net/xforce/xfdb/95493
URL:xforce.iss.net/xforce/xfdb/95494
14. Vulnerability in SolarWinds Storage Manager
[28/08/2014] Vulnerability was identified in the SolarWinds Storage Manager. An attacker could bypass security restrictions, execute arbitrary code and cause a denial of service condition. This vulnerability affects multiple versions of the mentioned product. Security patches are available to resolve this vulnerability.
URL:www.solarwinds.com/support/updates.aspx
URL:xforce.iss.net/xforce/xfdb/95559
15. Vulnerability in Linux Kernel (95556)
[28/08/2014] Vulnerability was identified in the Linux Kernel. An attacker could cause a denial of service condition and crash the system. The affected version was not specified. Security patches are available to resolve this vulnerability.
URL:xforce.iss.net/xforce/xfdb/95556
16. Vulnerability in MailPoet Newsletters Plugin for WordPress
[28/08/2014] Vulnerability was identified in the MailPoet Newsletters Plugin for WordPress. An attacker could bypass security restrictions, execute arbitrary code, perform cross-site scripting and cross-site request forgery attacks. This vulnerability affects versions prior to 2.6.11 of the mentioned product. Security patches are available to resolve this vulnerability.
URL:wordpress.org/plugins/wysija-newsletters/changelog/
URL:xforce.iss.net/xforce/xfdb/95500
17. Security Updates in Debian (DSA-3012-1)
[28/08/2014] Debian has released security update packages for fixing the vulnerability identified in the eglibc packages for multiple versions of Debian GNU/Linux. An attacker could execute arbitrary code and cause a denial of service condition.
URL:www.debian.org/security/2014/dsa-3012
18. Security Updates in Red Hat Products (RHSA-2014:1101-1, RHSA-2014:1102-1)
[28/08/2014] Red Hat has released security update packages for fixing the vulnerabilities identified in the kernel package for Red Hat Enterprise Linux 6, and the ror40-rubygem-activerecord package for Red Hat Software Collections 1 for RHEL 6. Due to multiple errors, an attacker could bypass security restrictions, gain elevated privileges, cause a denial of service condition and crash the system.
URL:rhn.redhat.com/errata/RHSA-2014-1101.html
URL:rhn.redhat.com/errata/RHSA-2014-1102.html
19. Vulnerability in Cisco Transport Gateway for Smart Call Home
[27/08/2014] Vulnerability was identified in the Cisco Transport Gateway for Smart Call Home. An attacker could bypass security restrictions and perform cross-site scripting attack. This vulnerability affects multiple firmware versions of the mentioned product. Security patches are available to resolve this vulnerability.
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3344
20. Vulnerabilities in IBM Products (N1020240, 1680665, 1681114, 1681214, 1681933, MIGR-5096132, MIGR-5096153)
[27/08/2014] Vulnerabilities were identified in the IBM i Operating System, IBM Emptoris Sourcing Portfolio, IBM HTTP Server, IBM Notes and Domino, IBM Content Integrator, IBM Sterling Control Center, IBM Fabric Manager and IBM Flex System Manager. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:www.ibm.com/support/docview.wss?uid=nas8N1020240
URL:www.ibm.com/support/docview.wss?uid=swg21680665
URL:www.ibm.com/support/docview.wss?uid=swg21681114
URL:www.ibm.com/support/docview.wss?uid=swg21681214
URL:www.ibm.com/support/docview.wss?uid=swg21681933
URL:www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096132
URL:www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096153
URL:xforce.iss.net/xforce/xfdb/91395
21. Vulnerabilities in Novell Products (5190470, 5190471, 5190472, 5190530, 5190531, 5190532, 5190550, 5190551, 5190552)
[27/08/2014] Vulnerabilities were identified in the Novell File Reporter, Novell GroupWise, Novell Kanaka for Mac and Novell Storage Manager. An attacker could bypass security restrictions, obtain sensitive information and execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:download.novell.com/Download?buildid=_aVoXvX0mJo~
URL:download.novell.com/Download?buildid=5bsZgAej4GI~
URL:download.novell.com/Download?buildid=-815P6M-Uq4~
URL:download.novell.com/Download?buildid=adKLQO6vZjA~
URL:download.novell.com/Download?buildid=dto6obSiSuM~
URL:download.novell.com/Download?buildid=m2NNE-BWQ58~
URL:download.novell.com/Download?buildid=MnyxLK-LI-E~
URL:download.novell.com/Download?buildid=NB35noeHLaY~
URL:download.novell.com/Download?buildid=NcCs0Ss65DU~
URL:download.novell.com/Download?buildid=p3OTSpSOkFI~
URL:download.novell.com/Download?buildid=PJTVAWcyTDs~
URL:download.novell.com/Download?buildid=tMSI_yfIplo~
URL:download.novell.com/Download?buildid=UwVDLUWGqag~
22. Vulnerabilities in Google Chrome
[27/08/2014] Vulnerabilities were identified in the Google Chrome. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code and compromise a vulnerable system. These vulnerabilities affect versions prior to 37.0.2062.94 of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:googlechromereleases.blogspot.hk/2014/08/stable-channel-update_26.html
URL:xforce.iss.net/xforce/xfdb/95468
URL:xforce.iss.net/xforce/xfdb/95470
URL:xforce.iss.net/xforce/xfdb/95475
URL:xforce.iss.net/xforce/xfdb/95476
23. Vulnerability in ntopng (95461)
[27/08/2014] Vulnerability was identified in the ntopng. An attacker could perform cross-site scripting attacks. This vulnerability affects version 1.2.0 of the mentioned product.
URL:xforce.iss.net/xforce/xfdb/95461
24. Vulnerability in VTLS Virtua (95464)
[27/08/2014] Vulnerability was identified in the VTLS Virtua. An attacker could perform code injection attacks. This vulnerability affects versions prior to 2014.1.1 and 2013.2.4 of the mentioned product. Security patches are available to resolve this vulnerability.
URL:xforce.iss.net/xforce/xfdb/95464
25. Vulnerability in MEHR Automation System (95465)
[27/08/2014] Vulnerability was identified in the MEHR Automation System. An attacker could bypass security restrictions and execute arbitrary code. The affected version was not specified.
URL:xforce.iss.net/xforce/xfdb/95465
26. Security Updates in Red Hat Products (RHSA-2014:1098-1)
[27/08/2014] Red Hat has released security update packages for fixing the vulnerability identified in the devtoolset-2-httpcomponents-client package for Red Hat Developer Toolset 2. An attacker could bypass security restrictions, obtain sensitive information and perform spoofing attacks.
URL:rhn.redhat.com/errata/RHSA-2014-1098.html
27. Vulnerability in Cisco IOS XR Software
[26/08/2014] Vulnerability was identified in the Cisco IOS XR Software for ASR 9000 Series Aggregation Services Routers. An attacker could bypass security restrictions and cause a denial of service condition. This vulnerability affects multiple firmware versions of the mentioned products. Security patches are available to resolve this vulnerability.
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3335
URL:xforce.iss.net/xforce/xfdb/95443
28. Vulnerabilities in HP Products (c04388127, c04398922, c04398943)
[26/08/2014] Vulnerabilities were identified in the HP Service Manager and HP-UX B.11.11, B.11.23, and B.11.31 running HP JDK and JRE. An attacker could bypass security restrictions, gain elevated privileges, execute arbitrary code, perform cross-site scripting and cross-site request forgery attacks and obtain sensitive information. These vulnerabilities affect multiple versions of mentioned products. Security patches are available to resolve these vulnerabilities.
URL:h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04388127
URL:h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04398922
URL:h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04398943
URL:xforce.iss.net/xforce/xfdb/95447
29. Vulnerabilities in IBM HTTP Server (1672428)
[26/08/2014] Vulnerabilities were identified in the IBM HTTP Server. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code and cause a denial of service condition. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:www.ibm.com/support/docview.wss?uid=swg21672428
URL:www.hkcert.org/my_url/en/alert/14082601
30. Vulnerabilities in Barracuda Networks Web Security Flex (95445, 95446)
[26/08/2014] Vulnerabilities were identified in the Barracuda Networks Web Security Flex. An attacker could bypass security restrictions, execute arbitrary code and perform cross-site scripting attacks. These vulnerabilities affect version 4.1 of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:xforce.iss.net/xforce/xfdb/95445
URL:xforce.iss.net/xforce/xfdb/95446
31. Vulnerabilities in Zarafa Products (95452, 95453)
[26/08/2014] Vulnerabilities were identified in multiple Zarafa products. An attacker could obtain sensitive information. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:xforce.iss.net/xforce/xfdb/95452
URL:xforce.iss.net/xforce/xfdb/95453
32. Vulnerabilities in phpMyAdmin (PMASA-2014-8, PMASA-2014-9)
[26/08/2014] Vulnerabilities were identified in the phpMyAdmin. An attacker could perform cross-site scripting and request forgery attacks. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:www.phpmyadmin.net/home_page/security/PMASA-2014-8.php
URL:www.phpmyadmin.net/home_page/security/PMASA-2014-9.php
33. Security Updates in Oracle Linux (ELSA-2014-3070)
[26/08/2014] Oracle has released security update packages for fixing the vulnerabilities identified in the kernel-uek packages for Oracle Linux 6 and 7. Due to multiple errors, an attacker could bypass security restrictions and obtain sensitive information.
URL:linux.oracle.com/errata/ELSA-2014-3070
34. Security Updates in Red Hat Products (RHSA-2014:1082-3, RHSA-2014:1091-1)
[26/08/2014] Red Hat has released security update packages for fixing the vulnerabilities identified in the thermostat1-httpcomponents-client package for Red Hat Software Collections 1 and the mod_wsgi package for Red Hat Enterprise Linux 7. Due to multiple errors, an attacker could bypass security restrictions, gain elevated privileges, obtain sensitive information and execute arbitrary code.
URL:rhn.redhat.com/errata/RHSA-2014-1082.html
URL:rhn.redhat.com/errata/RHSA-2014-1091.html
35. Security Updates in Ubuntu GNU/Linux (USN-2319-2)
[26/08/2014] Ubuntu has released security update packages for fixing the vulnerabilities identified in the openjdk-7 package for version 14.04 LTS of Ubuntu GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code and cause a denial of service condition.
URL:www.ubuntu.com/usn/usn-2319-2/
36. Vulnerabilities in Apache OpenOffice.org
[25/08/2014] Vulnerabilities were identified in the Apache OpenOffice.org. An attacker could bypass security restrictions, obtain sensitive information and execute arbitrary code. These vulnerabilities affect versions prior to 4.1.1 of mentioned product. Security patches are available to resolve these vulnerabilities.
URL:blogs.apache.org/OOo/entry/announcing_apache_openoffice_4_1
URL:xforce.iss.net/xforce/xfdb/95420
URL:xforce.iss.net/xforce/xfdb/95421
37. Vulnerability in IBM AIX and Virtual I/O Server
[25/08/2014] Vulnerability was identified in the Libxml2 package included in IBM AIX and Virtual I/O Server. An attacker could bypass security restrictions and cause a denial of service condition. This vulnerability affects versions 6.1 and 7.1 of IBM AIX, and versions 2.2.x of IBM Virtual I/O Server. Security patches are available to resolve this vulnerability.
URL:aix.software.ibm.com/aix/efixes/security/libxml2_advisory.asc
38. Vulnerability in Huawei Android Devices (Huawei-SA-20140821-Android)
[25/08/2014] Vulnerability was identified in the Huawei Android devices. An attacker could bypass security restrictions, execute arbitrary code and cause a denial of service condition. This vulnerability affects firmware version V100R001 of the mentioned products. Security patches are available to resolve this vulnerability.
URL:www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-363101.htm
39. Vulnerability in MyBB (95411)
[25/08/2014] Vulnerability was identified in the MyBB. An attacker could bypass security restrictions, execute arbitrary code and perform cross-site scripting attacks. This vulnerability affects version 1.8 Beta 3 of the mentioned product.
URL:xforce.iss.net/xforce/xfdb/95411
40. Vulnerability in PHP (95408)
[25/08/2014] Vulnerability was identified in the PHP. An attacker could cause a denial of service condition and crash the system. This vulnerability affects versions 5.4.1 and 5.4.2 of the mentioned product. Security patches are available to resolve this vulnerability.
URL:xforce.iss.net/xforce/xfdb/95408
41. Vulnerability in QEMU (95419)
[25/08/2014] Vulnerability was identified in the QEMU. An attacker could execute arbitrary code and obtain sensitive information. The affected version was not specified. Security patches are available to resolve this vulnerability.
URL:xforce.iss.net/xforce/xfdb/95419
42. Vulnerabilities in WinSCP
[25/08/2014] Vulnerabilities were identified in the WinSCP. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code, cause a denial of service condition and compromise a user's system. These vulnerabilities affect versions prior to 5.5.5 of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:winscp.net/eng/docs/history#5.5.5
43. Security Updates in Debian (DSA-3009-1, DSA-3010-1, DSA-3011-1)
[25/08/2014] Debian has released security update packages for fixing the vulnerabilities identified in the python-imaging, python-django and mediawiki packages for multiple versions of Debian GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code, perform code injection attacks, cause a denial of service condition and crash the system.
URL:www.debian.org/security/2014/dsa-3009
URL:www.debian.org/security/2014/dsa-3010
URL:www.debian.org/security/2014/dsa-3011
[29/08/2014] Vulnerability was identified in the Apache HttpClient and Apache HttpAsyncClient. An attacker could perform man-in-the-middle attacks. This vulnerability affects versions prior to 4.3.5 of Apache HttpClient, and versions prior to 4.0.2 of Apache HttpAsyncClient. Security patches are available to resolve this vulnerability.
URL:mail-archives.apache.org/mod_mbox/www-announce/201408.mbox/CVE-2014-3577
2. Vulnerabilities in Cisco Cloud Portal
[29/08/2014] Vulnerabilities were identified in the Cisco Cloud Portal. An attacker could obtain sensitive information and execute arbitrary code. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3349
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3350
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3351
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3352
URL:xforce.iss.net/xforce/xfdb/95585
URL:xforce.iss.net/xforce/xfdb/95586
URL:xforce.iss.net/xforce/xfdb/95587
3. Vulnerabilities in IBM Products (1680453, 1680454, 1681277)
[29/08/2014] Vulnerabilities were identified in the IBM Tivoli Storage Manager (TSM) and IBM Emptoris Spend Analysis. An attacker could bypass security restrictions, gain elevated privileges, perform cross-site scripting and phishing attacks. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:www.ibm.com/support/docview.wss?uid=swg21680453
URL:www.ibm.com/support/docview.wss?uid=swg21680454
URL:www.ibm.com/support/docview.wss?uid=swg21681277
4. Vulnerabilities in Django (95564, 95566, 95567, 95569)
[29/08/2014] Vulnerabilities were identified in the Django. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code and cause a denial of service condition. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:xforce.iss.net/xforce/xfdb/95564
URL:xforce.iss.net/xforce/xfdb/95566
URL:xforce.iss.net/xforce/xfdb/95567
URL:xforce.iss.net/xforce/xfdb/95569
5. Vulnerabilities in ManageEngine Products (95562, 95565)
[29/08/2014] Vulnerabilities were identified in the ManageEngine DeviceExpert and ManageEngine EventLog Analyzer. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code and perform cross-site scripting attacks. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve the vulnerability of the EventLog Analyzer.
URL:xforce.iss.net/xforce/xfdb/95562
URL:xforce.iss.net/xforce/xfdb/95565
6. Security Updates in Debian (DSA-3013-1, DSA-3014-1)
[29/08/2014] Debian has released security update packages for fixing the vulnerabilities identified in the s3ql and squid3 packages for multiple versions of Debian GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, execute arbitrary code and cause a denial of service condition.
URL:www.debian.org/security/2014/dsa-3013
URL:www.debian.org/security/2014/dsa-3014
7. Security Updates in SUSE (SUSE-SU-2014:1072-1)
[29/08/2014] SUSE has released security update packages for fixing the vulnerabilities identified in the MySQL packages for SUSE Linux Enterprise 11. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information and execute arbitrary code.
URL:lists.opensuse.org/opensuse-security-announce/2014-08/msg00012.html
8. Security Updates in Ubuntu GNU/Linux (USN-2327-1, USN-2328-1)
[29/08/2014] Ubuntu has released security update packages for fixing the vulnerabilities identified in the squid3 and eglibc packages for versions 10.04 LTS, 12.04 LTS and 14.04 LTS of Ubuntu GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, gain elevated privileges, execute arbitrary code and cause a denial of service condition.
URL:www.ubuntu.com/usn/usn-2327-1/
URL:www.ubuntu.com/usn/usn-2328-1/
9. Information Updates on Microsoft Security Bulletin (MS14-045)
[28/08/2014] Microsoft has updated information on the Security Bulletin for Microsoft Windows. MS14-045 was rereleased to announce the replacement of the 2982791 update with the 2993651 update for all supported releases of Microsoft Windows.
URL:technet.microsoft.com/library/security/ms14-045
10. Vulnerabilities in Cisco Products
[28/08/2014] Vulnerabilities were identified in the Cisco Transport Gateway for Smart Call Home and Cisco 1800 Series Integrated Services Routers. An attacker could bypass security restrictions, execute arbitrary code and cause a denial of service condition. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3345
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3346
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3347
URL:xforce.iss.net/xforce/xfdb/95558
11. Vulnerability in IBM DB2 Accessories Suite (1682096)
[28/08/2014] Vulnerability was identified in the IBM DB2 Accessories Suite. An attacker could cause a denial of service condition and execute arbitrary code. This vulnerability affects versions 10.1 and 10.5 of the mentioned product. Security patches are available to resolve this vulnerability.
URL:www.ibm.com/support/docview.wss?uid=swg21682096
12. Vulnerability in Novell GroupWise (7015566)
[28/08/2014] Vulnerability was identified in the GroupWise 2014 Administration service. An attacker could bypass security restrictions, obtain sensitive information and execute arbitrary code. This vulnerability affects versions prior to Support Pack 1 (SP1) of the mentioned product. Security patches are available to resolve this vulnerability.
URL:www.novell.com/support/kb/doc.php?id=7015566
URL:xforce.iss.net/xforce/xfdb/95557
13. Vulnerabilities in VMware Support Tool (95493, 95494)
[28/08/2014] Vulnerabilities were identified in the VMware Support Tool. An attacker could bypass security restrictions, cause a denial of service condition and crash the system. These vulnerabilities affect version vm-support 0.88 of the mentioned product.
URL:xforce.iss.net/xforce/xfdb/95493
URL:xforce.iss.net/xforce/xfdb/95494
14. Vulnerability in SolarWinds Storage Manager
[28/08/2014] Vulnerability was identified in the SolarWinds Storage Manager. An attacker could bypass security restrictions, execute arbitrary code and cause a denial of service condition. This vulnerability affects multiple versions of the mentioned product. Security patches are available to resolve this vulnerability.
URL:www.solarwinds.com/support/updates.aspx
URL:xforce.iss.net/xforce/xfdb/95559
15. Vulnerability in Linux Kernel (95556)
[28/08/2014] Vulnerability was identified in the Linux Kernel. An attacker could cause a denial of service condition and crash the system. The affected version was not specified. Security patches are available to resolve this vulnerability.
URL:xforce.iss.net/xforce/xfdb/95556
16. Vulnerability in MailPoet Newsletters Plugin for WordPress
[28/08/2014] Vulnerability was identified in the MailPoet Newsletters Plugin for WordPress. An attacker could bypass security restrictions, execute arbitrary code, perform cross-site scripting and cross-site request forgery attacks. This vulnerability affects versions prior to 2.6.11 of the mentioned product. Security patches are available to resolve this vulnerability.
URL:wordpress.org/plugins/wysija-newsletters/changelog/
URL:xforce.iss.net/xforce/xfdb/95500
17. Security Updates in Debian (DSA-3012-1)
[28/08/2014] Debian has released security update packages for fixing the vulnerability identified in the eglibc packages for multiple versions of Debian GNU/Linux. An attacker could execute arbitrary code and cause a denial of service condition.
URL:www.debian.org/security/2014/dsa-3012
18. Security Updates in Red Hat Products (RHSA-2014:1101-1, RHSA-2014:1102-1)
[28/08/2014] Red Hat has released security update packages for fixing the vulnerabilities identified in the kernel package for Red Hat Enterprise Linux 6, and the ror40-rubygem-activerecord package for Red Hat Software Collections 1 for RHEL 6. Due to multiple errors, an attacker could bypass security restrictions, gain elevated privileges, cause a denial of service condition and crash the system.
URL:rhn.redhat.com/errata/RHSA-2014-1101.html
URL:rhn.redhat.com/errata/RHSA-2014-1102.html
19. Vulnerability in Cisco Transport Gateway for Smart Call Home
[27/08/2014] Vulnerability was identified in the Cisco Transport Gateway for Smart Call Home. An attacker could bypass security restrictions and perform cross-site scripting attack. This vulnerability affects multiple firmware versions of the mentioned product. Security patches are available to resolve this vulnerability.
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3344
20. Vulnerabilities in IBM Products (N1020240, 1680665, 1681114, 1681214, 1681933, MIGR-5096132, MIGR-5096153)
[27/08/2014] Vulnerabilities were identified in the IBM i Operating System, IBM Emptoris Sourcing Portfolio, IBM HTTP Server, IBM Notes and Domino, IBM Content Integrator, IBM Sterling Control Center, IBM Fabric Manager and IBM Flex System Manager. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:www.ibm.com/support/docview.wss?uid=nas8N1020240
URL:www.ibm.com/support/docview.wss?uid=swg21680665
URL:www.ibm.com/support/docview.wss?uid=swg21681114
URL:www.ibm.com/support/docview.wss?uid=swg21681214
URL:www.ibm.com/support/docview.wss?uid=swg21681933
URL:www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096132
URL:www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096153
URL:xforce.iss.net/xforce/xfdb/91395
21. Vulnerabilities in Novell Products (5190470, 5190471, 5190472, 5190530, 5190531, 5190532, 5190550, 5190551, 5190552)
[27/08/2014] Vulnerabilities were identified in the Novell File Reporter, Novell GroupWise, Novell Kanaka for Mac and Novell Storage Manager. An attacker could bypass security restrictions, obtain sensitive information and execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:download.novell.com/Download?buildid=_aVoXvX0mJo~
URL:download.novell.com/Download?buildid=5bsZgAej4GI~
URL:download.novell.com/Download?buildid=-815P6M-Uq4~
URL:download.novell.com/Download?buildid=adKLQO6vZjA~
URL:download.novell.com/Download?buildid=dto6obSiSuM~
URL:download.novell.com/Download?buildid=m2NNE-BWQ58~
URL:download.novell.com/Download?buildid=MnyxLK-LI-E~
URL:download.novell.com/Download?buildid=NB35noeHLaY~
URL:download.novell.com/Download?buildid=NcCs0Ss65DU~
URL:download.novell.com/Download?buildid=p3OTSpSOkFI~
URL:download.novell.com/Download?buildid=PJTVAWcyTDs~
URL:download.novell.com/Download?buildid=tMSI_yfIplo~
URL:download.novell.com/Download?buildid=UwVDLUWGqag~
22. Vulnerabilities in Google Chrome
[27/08/2014] Vulnerabilities were identified in the Google Chrome. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code and compromise a vulnerable system. These vulnerabilities affect versions prior to 37.0.2062.94 of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:googlechromereleases.blogspot.hk/2014/08/stable-channel-update_26.html
URL:xforce.iss.net/xforce/xfdb/95468
URL:xforce.iss.net/xforce/xfdb/95470
URL:xforce.iss.net/xforce/xfdb/95475
URL:xforce.iss.net/xforce/xfdb/95476
23. Vulnerability in ntopng (95461)
[27/08/2014] Vulnerability was identified in the ntopng. An attacker could perform cross-site scripting attacks. This vulnerability affects version 1.2.0 of the mentioned product.
URL:xforce.iss.net/xforce/xfdb/95461
24. Vulnerability in VTLS Virtua (95464)
[27/08/2014] Vulnerability was identified in the VTLS Virtua. An attacker could perform code injection attacks. This vulnerability affects versions prior to 2014.1.1 and 2013.2.4 of the mentioned product. Security patches are available to resolve this vulnerability.
URL:xforce.iss.net/xforce/xfdb/95464
25. Vulnerability in MEHR Automation System (95465)
[27/08/2014] Vulnerability was identified in the MEHR Automation System. An attacker could bypass security restrictions and execute arbitrary code. The affected version was not specified.
URL:xforce.iss.net/xforce/xfdb/95465
26. Security Updates in Red Hat Products (RHSA-2014:1098-1)
[27/08/2014] Red Hat has released security update packages for fixing the vulnerability identified in the devtoolset-2-httpcomponents-client package for Red Hat Developer Toolset 2. An attacker could bypass security restrictions, obtain sensitive information and perform spoofing attacks.
URL:rhn.redhat.com/errata/RHSA-2014-1098.html
27. Vulnerability in Cisco IOS XR Software
[26/08/2014] Vulnerability was identified in the Cisco IOS XR Software for ASR 9000 Series Aggregation Services Routers. An attacker could bypass security restrictions and cause a denial of service condition. This vulnerability affects multiple firmware versions of the mentioned products. Security patches are available to resolve this vulnerability.
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3335
URL:xforce.iss.net/xforce/xfdb/95443
28. Vulnerabilities in HP Products (c04388127, c04398922, c04398943)
[26/08/2014] Vulnerabilities were identified in the HP Service Manager and HP-UX B.11.11, B.11.23, and B.11.31 running HP JDK and JRE. An attacker could bypass security restrictions, gain elevated privileges, execute arbitrary code, perform cross-site scripting and cross-site request forgery attacks and obtain sensitive information. These vulnerabilities affect multiple versions of mentioned products. Security patches are available to resolve these vulnerabilities.
URL:h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04388127
URL:h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04398922
URL:h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04398943
URL:xforce.iss.net/xforce/xfdb/95447
29. Vulnerabilities in IBM HTTP Server (1672428)
[26/08/2014] Vulnerabilities were identified in the IBM HTTP Server. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code and cause a denial of service condition. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:www.ibm.com/support/docview.wss?uid=swg21672428
URL:www.hkcert.org/my_url/en/alert/14082601
30. Vulnerabilities in Barracuda Networks Web Security Flex (95445, 95446)
[26/08/2014] Vulnerabilities were identified in the Barracuda Networks Web Security Flex. An attacker could bypass security restrictions, execute arbitrary code and perform cross-site scripting attacks. These vulnerabilities affect version 4.1 of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:xforce.iss.net/xforce/xfdb/95445
URL:xforce.iss.net/xforce/xfdb/95446
31. Vulnerabilities in Zarafa Products (95452, 95453)
[26/08/2014] Vulnerabilities were identified in multiple Zarafa products. An attacker could obtain sensitive information. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.
URL:xforce.iss.net/xforce/xfdb/95452
URL:xforce.iss.net/xforce/xfdb/95453
32. Vulnerabilities in phpMyAdmin (PMASA-2014-8, PMASA-2014-9)
[26/08/2014] Vulnerabilities were identified in the phpMyAdmin. An attacker could perform cross-site scripting and request forgery attacks. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:www.phpmyadmin.net/home_page/security/PMASA-2014-8.php
URL:www.phpmyadmin.net/home_page/security/PMASA-2014-9.php
33. Security Updates in Oracle Linux (ELSA-2014-3070)
[26/08/2014] Oracle has released security update packages for fixing the vulnerabilities identified in the kernel-uek packages for Oracle Linux 6 and 7. Due to multiple errors, an attacker could bypass security restrictions and obtain sensitive information.
URL:linux.oracle.com/errata/ELSA-2014-3070
34. Security Updates in Red Hat Products (RHSA-2014:1082-3, RHSA-2014:1091-1)
[26/08/2014] Red Hat has released security update packages for fixing the vulnerabilities identified in the thermostat1-httpcomponents-client package for Red Hat Software Collections 1 and the mod_wsgi package for Red Hat Enterprise Linux 7. Due to multiple errors, an attacker could bypass security restrictions, gain elevated privileges, obtain sensitive information and execute arbitrary code.
URL:rhn.redhat.com/errata/RHSA-2014-1082.html
URL:rhn.redhat.com/errata/RHSA-2014-1091.html
35. Security Updates in Ubuntu GNU/Linux (USN-2319-2)
[26/08/2014] Ubuntu has released security update packages for fixing the vulnerabilities identified in the openjdk-7 package for version 14.04 LTS of Ubuntu GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code and cause a denial of service condition.
URL:www.ubuntu.com/usn/usn-2319-2/
36. Vulnerabilities in Apache OpenOffice.org
[25/08/2014] Vulnerabilities were identified in the Apache OpenOffice.org. An attacker could bypass security restrictions, obtain sensitive information and execute arbitrary code. These vulnerabilities affect versions prior to 4.1.1 of mentioned product. Security patches are available to resolve these vulnerabilities.
URL:blogs.apache.org/OOo/entry/announcing_apache_openoffice_4_1
URL:xforce.iss.net/xforce/xfdb/95420
URL:xforce.iss.net/xforce/xfdb/95421
37. Vulnerability in IBM AIX and Virtual I/O Server
[25/08/2014] Vulnerability was identified in the Libxml2 package included in IBM AIX and Virtual I/O Server. An attacker could bypass security restrictions and cause a denial of service condition. This vulnerability affects versions 6.1 and 7.1 of IBM AIX, and versions 2.2.x of IBM Virtual I/O Server. Security patches are available to resolve this vulnerability.
URL:aix.software.ibm.com/aix/efixes/security/libxml2_advisory.asc
38. Vulnerability in Huawei Android Devices (Huawei-SA-20140821-Android)
[25/08/2014] Vulnerability was identified in the Huawei Android devices. An attacker could bypass security restrictions, execute arbitrary code and cause a denial of service condition. This vulnerability affects firmware version V100R001 of the mentioned products. Security patches are available to resolve this vulnerability.
URL:www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-363101.htm
39. Vulnerability in MyBB (95411)
[25/08/2014] Vulnerability was identified in the MyBB. An attacker could bypass security restrictions, execute arbitrary code and perform cross-site scripting attacks. This vulnerability affects version 1.8 Beta 3 of the mentioned product.
URL:xforce.iss.net/xforce/xfdb/95411
40. Vulnerability in PHP (95408)
[25/08/2014] Vulnerability was identified in the PHP. An attacker could cause a denial of service condition and crash the system. This vulnerability affects versions 5.4.1 and 5.4.2 of the mentioned product. Security patches are available to resolve this vulnerability.
URL:xforce.iss.net/xforce/xfdb/95408
41. Vulnerability in QEMU (95419)
[25/08/2014] Vulnerability was identified in the QEMU. An attacker could execute arbitrary code and obtain sensitive information. The affected version was not specified. Security patches are available to resolve this vulnerability.
URL:xforce.iss.net/xforce/xfdb/95419
42. Vulnerabilities in WinSCP
[25/08/2014] Vulnerabilities were identified in the WinSCP. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code, cause a denial of service condition and compromise a user's system. These vulnerabilities affect versions prior to 5.5.5 of the mentioned product. Security patches are available to resolve these vulnerabilities.
URL:winscp.net/eng/docs/history#5.5.5
43. Security Updates in Debian (DSA-3009-1, DSA-3010-1, DSA-3011-1)
[25/08/2014] Debian has released security update packages for fixing the vulnerabilities identified in the python-imaging, python-django and mediawiki packages for multiple versions of Debian GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code, perform code injection attacks, cause a denial of service condition and crash the system.
URL:www.debian.org/security/2014/dsa-3009
URL:www.debian.org/security/2014/dsa-3010
URL:www.debian.org/security/2014/dsa-3011
Subscribe to:
Posts (Atom)