Re: [oss-security] CVE-2016-4484: - Cryptsetup Initrd root Shell

2016-11-14 Thread Leo Famulari
On Mon, Nov 14, 2016 at 08:45:51PM +, Hector Marco wrote: > Hello All, > > Affected package > > Cryptsetup <= 2:1 Hi, Can you clarify which versions are affected? The latest upstream version is 1.7.3: https://gitlab.com/cryptsetup/cryptsetup/commits/master What is the 2:1

Actiontec WCB3000N (Telus Branded) Local Unauthenticated Privilege Elevation and Password Reset

2016-11-14 Thread Andrew Klaus
### Device Details Vendor: Actiontec (Telus Branded) Model: WCB3000N Affected Firmware: v0.16.2.5 Device Manual: http://static.telus.com/common/cms/files/internet/wifi_plus_extender.pdf Reported: November 2015 Status: Fixed on newest pushed firmware version CVE: Update is handled by the vendor,

CVE-2016-4484: - Cryptsetup Initrd root Shell

2016-11-14 Thread Hector Marco
Hello All, Affected package Cryptsetup <= 2:1 CVE-ID -- CVE-2016-4484 Description --- A vulnerability in Cryptsetup, concretely in the scripts that unlock the system partition when the partition is ciphered using LUKS (Linux Unified Key Setup). This vulnerability

[security bulletin] HPSBUX03665 rev.2 - HP-UX Tomcat-based Servlet Engine, Remote Denial of Service (DoS) and URL Redirection

2016-11-14 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05324759 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05324759 Version: 2 HPSBUX03665 rev.2 - HP-UX

[security bulletin] HPSBGN03669 rev.1 - HPE SiteScope, Local Elevation of Privilege, Remote Denial of Service, Arbitrary Code Execution and Cross-Site Request Forgery

2016-11-14 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05324755 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05324755 Version: 1 HPSBGN03669 rev.1 - HPE S

Multiple vulnerabilities in Barco Clickshare

2016-11-14 Thread vincent.ruijter
CVE-2016-3149 - Remote Code Execution in Barco ClickShare CSC-1 and CSM-1 Affected versions: all versions prior to v01.09.03 (CSC-1) and v01.06.02 (CSM-1). A remote code execution vulnerability exists within the Barco ClickShare base unit software, that could lead to full compromise of the applia

SEC Consult SA-20161114-0 :: Multiple vulnerabilities in I-Panda SolarEagle - Solar Controller Administration Software / MPPT Solar Controller SMART2

2016-11-14 Thread SEC Consult Vulnerability Lab
SEC Consult Vulnerability Lab Security Advisory < 20161114-0 > === title: Multiple vulnerabilities product: I-Panda SolarEagle - Solar Controller Administration Software / MPPT

CVE-2015-0040: Microsoft Internet Explorer 11 MSHTML CMapElement::Notify use-after-free details

2016-11-14 Thread Berend-Jan Wever
Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the tenth entry in that series. The below information is available in more detail on my blog at http://blog.skylined.nl/20161114001.html. Follow me on http://twitter.c

WHM Panel Mail Delivery Reports crash database Vulnerability

2016-11-14 Thread iedb . team
Mail Delivery Reports crash database Local Vulnerability in WHM Panel All Version ### # WHM Panel Mail Delivery Reports crash database Vulnerability ### # # Iranian Exploit DataBase And Securi

[CVE-2016-8736] Apache Openmeetings RMI Registry Java Deserialization RCE

2016-11-14 Thread Maxim Solodovnik
Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings 3.1.0 Description: Apache Openmeetings is vulnerable to Remote Code Execution via RMI deserialization attack The issue was fixed in 3.1.2 All users are recommended to upgrade to Apache OpenMeetings

WHM Panel Mail Delivery Reports crash database Vulnerability

2016-11-14 Thread iedb . team
Mail Delivery Reports crash database in whm panel 60.0 ( build 17) version local exploit Pic:http://kkli.ir/C6LGY # # Iranian Exploit DataBase And Security Team - iedb.ir # Title : WHM Panel Mail Delivery Reports crash database Vulnerability

CVE-2016-9277: A IDX Out of Bound vulnerability in systemui can make crash and ui restart

2016-11-14 Thread unlimitsec
Description of the potential vulnerability: Severity: Low Affected versions: L(5.0/5.1), M(6.0) Disclosure status: Privately disclosed. One of the activities in SystemUI can produce array index out of bounds exception as a combination of some APIs and it leads to UI restart. The patch fixes the vu

[SECURITY] [DSA 3711-1] mariadb-10.0 security update

2016-11-14 Thread Salvatore Bonaccorso
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3711-1 secur...@debian.org https://www.debian.org/security/ Salvatore Bonaccorso November 11, 2016