CVE-2013-2153: Apache Santuario C++ signature bypass vulnerability

2013-06-18 Thread Cantor, Scott
CVE-2013-2153: Apache Santuario XML Security for C++ contains an XML Signature Bypass issue Severity: Critical Vendor: The Apache Software Foundation Versions Affected: Apache Santuario XML Security for C++ library versions prior to V1.7.1 Description: The implementation of XML digital

CVE-2013-2155: Apache Santuario C++ denial of service vulnerability

2013-06-18 Thread Cantor, Scott
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 CVE-2013-2155: Apache Santuario XML Security for C++ contains denial of service and hash length bypass issues while processing HMAC signatures Severity: Critical Vendor: The Apache Software Foundation Versions Affected: Apache Santuario XML

CVE-2013-2154: Apache Santuario C++ stack overflow vulnerability

2013-06-18 Thread Cantor, Scott
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 CVE-2013-2154: Apache Santuario XML Security for C++ contains a stack overflow during XPointer evaluation Severity: Critical Vendor: The Apache Software Foundation Versions Affected: Apache Santuario XML Security for C++ library versions prior to

Re: CVE-2013-2156: Apache Santuario C++ heap overflow vulnerability

2013-06-18 Thread Cantor, Scott
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 CVE-2013-2156: Apache Santuario XML Security for C++ contains heap overflow while processing InclusiveNamespace PrefixList Severity: Critical Vendor: The Apache Software Foundation Versions Affected: Apache Santuario XML Security for C++ library

FreeBSD Security Advisory FreeBSD-SA-13:06.mmap

2013-06-18 Thread FreeBSD Security Advisories
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 = FreeBSD-SA-13:06.mmap Security Advisory The FreeBSD Project Topic:

[SECURITY] [DSA 2710-1] xml-security-c security update

2013-06-18 Thread Salvatore Bonaccorso
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-2710-1 secur...@debian.org http://www.debian.org/security/ Salvatore Bonaccorso June 18, 2013

Apple and Wifi Hotspot Credentials Management Vulnerability

2013-06-18 Thread Jeffrey Walton
This vulnerability was published to the OWASP Mobile Security list as a research paper by Andreas Kurtz, Daniel Metz and Felix Freiling. See Cracking iOS personal hotspots using a Scrabble crossword game word list,

Re: Apple and Wifi Hotspot Credentials Management Vulnerability

2013-06-18 Thread Jeffrey Walton
On Mon, Jun 17, 2013 at 3:35 PM, Jeffrey Walton noloa...@gmail.com wrote: ... It appears Apple Wifi hotspot passwords are generated using a wordlist consisting of 1842 words. The authors built a customer cracker to aide in recovery of the Wifi hotspot passwords. My bad. The application

APPLE-SA-2013-06-18-1 Java for OS X 2013-004 and Mac OS X v10.6 Update 16

2013-06-18 Thread Apple Product Security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 APPLE-SA-2013-06-18-1 Java for OS X 2013-004 and Mac OS X v10.6 Update 16 Java for OS X 2013-004 and Mac OS X v10.6 Update 16 is now available and addresses the following: Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion

[SECURITY] [DSA 2698-1] tiff security update

2013-06-18 Thread Michael Gilbert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2698-1 secur...@debian.org http://www.debian.org/security/ Michael Gilbert June 18, 2013

[SECURITY] [DSA 2628-2] nss-pam-ldapd update

2013-06-18 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2628-2 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff June 18, 2013