[SECURITY] [DSA 2875-1] cups-filters security update

2014-03-12 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2875-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff March 12, 2014

[SECURITY] [DSA 2874-1] mutt security update

2014-03-12 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2874-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff March 12, 2014

[SECURITY] [DSA 2876-1] cups security update

2014-03-12 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2876-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff March 12, 2014

Cross-Site Scripting (XSS) in Open Classifieds

2014-03-12 Thread High-Tech Bridge Security Research
Advisory ID: HTB23204 Product: Open Classifieds Vendor: Open Classifieds Team Vulnerable Version(s): 2-2.1.2 and probably prior Tested Version: 2-2.1.2 Advisory Publication: February 19, 2014 [without technical details] Vendor Notification: February 19, 2014 Vendor Patch: February 20, 2014 Publ

Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem

2014-03-12 Thread Larry W. Cashdollar
Title: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem Author: Larry W. Cashdollar, @_larry0 Download Site: http://rubygems.org/gems/Arabic-Prawn CVE: 2014-2322 Date: 12/17/2013 In Arabic-Prawn-0.0.1/lib/string_utf_support.rb, the following lines pass unsanitized input to the shell. 4

CVE-2014-2043 - SQL Injection in Procentia IntelliPen

2014-03-12 Thread Portcullis Advisories
Vulnerability title: SQL Injection in Procentia IntelliPen CVE: CVE-2014-2043 Vendor: Procentia Product: IntelliPen Affected version: 1.1.12.1520 Fixed version: 1.1.18.1658 Reported by: Jerzy Kramarz Details: SQL injection has been found and confirmed within the software as an authenticated user.

CVE-2014-1222 - Local File Inclusion in Vtiger CRM

2014-03-12 Thread Portcullis Advisories
Vulnerability title: Local File Inclusion in Vtiger CRM CVE: CVE-2014-1222 Vendor: Vtiger Product: CRM Affected version: Vtiger CRM 5.4.0, 6.0 RC & 6.0.0 GA Fixed version: Vtiger CRM 6.0.0 Security patch 1 Reported by: Jerzy Kramarz Details: A local file inclusion vulnerability was discovered in

NEW VMSA-2014-0002 VMware vSphere updates to third party libraries

2014-03-12 Thread "VMware Security Response Center"
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - --- VMware Security Advisory Advisory ID: VMSA-2014-0002 Synopsis:VMware vSphere updates to third party libraries Issue date: 2014-03-11 Updated on: 2014-03-11 (initial advis

CVE-2014-0097 Spring Security Blank password may bypass user authentication

2014-03-12 Thread Pivotal Security Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2014-0097 Blank password may bypass user authentication Severity: Important Vendor: Spring by Pivotal Versions Affected: - - Spring Security 3.2.0 to 3.2.1 - - Spring Security 3.1.0 to 3.1.5 Description: The ActiveDirectoryLdapAuthenticator doe

CVE-2014-1904 XSS when using Spring MVC

2014-03-12 Thread Pivotal Security Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2014-1904 XSS when using Spring MVC Severity: Moderate Vendor: Spring by Pivotal Versions Affected: - - Spring MVC 3.0.0 to 3.2.8 - - Spring MVC 4.0.0 to 4.0.1 - - Earlier unsupported versions may be affected Description: When a programmer does

CVE-2014-0054 Spring MVC Incomplete fix for CVE-2013-4152 / CVE-2013-6429 (XXE)

2014-03-12 Thread Pivotal Security Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2014-0054 Incomplete fix for CVE-2013-4152 / CVE-2013-6429 (XXE) Severity: Important Vendor: Spring by Pivotal Versions Affected: - - Spring MVC 3.0.0 to 3.2.8 - - Spring MVC 4.0.0 to 4.0.1 - - Earlier unsupported versions may be affected Descr

[SECURITY] [DSA 2873-1] file security update

2014-03-12 Thread Salvatore Bonaccorso
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-2873-1 secur...@debian.org http://www.debian.org/security/ Salvatore Bonaccorso March 11, 2014

Medium severity flaw in BlackBerry QNX Neutrino RTOS

2014-03-12 Thread Tim Brown
Summary This advisory concerns the forced disclosure of 2 vulnerabilities that were previously disclosed to BlackBerry. Disclosure has been forced since these vulnerabilities have been publicly disclosed (with PoC) on the exploit-db web site. Two local privilege escalation vulnerabilities have b

CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities

2014-03-12 Thread CORE Advisories Team
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities 1. *Advisory Information* Title: Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities Advisory ID: CORE-2014-0002 Advisory UR