VU#973527: Dnsmasq contains multiple vulnerabilities
Dnsmasq versions 2.77 and earlier contains multiple vulnerabilities. Continue reading VU#973527: Dnsmasq contains multiple vulnerabilities
Author Archives: CERT
VU#101048: Microsoft .NET framework SOAP Moniker PrintClientProxy remote code execution vulnerability
The Microsoft.NET framework fails to properly parse WSDL content,which can allow a remote,unauthenticated attacker to execute arbitrary code on a vulnerable system. Continue reading VU#101048: Microsoft .NET framework SOAP Moniker PrintClientProxy remote code execution vulnerability
VU#101048: Microsoft .NET framework WSDL parser PrintClientProxy remote code execution vulnerability
The Microsoft.NET framework fails to properly parse WSDL content,which can allow a remote,unauthenticated attacker to execute arbitrary code on a vulnerable system. Continue reading VU#101048: Microsoft .NET framework WSDL parser PrintClientProxy remote code execution vulnerability
VU#240311: Multiple Bluetooth implementation vulnerabilities affect many devices
A collection of Bluetooth implementation vulnerabilities known as"BlueBorne"has been released. These vulnerabilities collectively affect Windows,iOS,and Linux-kernel-based operating systems including Android and Tizen,and may in worst case allow an unauthenticated attacker to perform commands on the device. Continue reading VU#240311: Multiple Bluetooth implementation vulnerabilities affect many devices
VU#166743: Das U-Boot AES-CBC encryption implementation contains multiple vulnerabilities
Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode,U-Boot’s use of a zero initialization vector and improper handling of an error condition may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Continue reading VU#166743: Das U-Boot AES-CBC encryption implementation contains multiple vulnerabilities
VU#166743: Das U-Boot AES-CBC encryption implementation contains multiple vulnerabilities
Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode,U-Boot’s use of a zero initialization vector and improper handling of an error condition may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Continue reading VU#166743: Das U-Boot AES-CBC encryption implementation contains multiple vulnerabilities
VU#112992: Apache Struts 2 framework REST plugin insecurely deserializes untrusted XML data
Apache Struts 2 framework,versions 2.5 to 2.5.12,with REST plugin insecurely deserializes untrusted XML data. A remote,unauthenticated attacker can leverage this vulnerability to execute arbitrary code in the context of the Struts application. Continue reading VU#112992: Apache Struts 2 framework REST plugin insecurely deserializes untrusted XML data
VU#403768: Akeo Consulting Rufus fails to update itself securely
Akeo Consulting Rufus fails to securely check for and retrieve updates,which an allow an authenticated attacker to execute arbitrary code on a vulnerable system. Continue reading VU#403768: Akeo Consulting Rufus fails to update itself securely
VU#824672: Microsoft Windows automatically executes code specified in shortcut files
Microsoft Windows automatically executes code specified in shortcut(LNK)files. Continue reading VU#824672: Microsoft Windows automatically executes code specified in shortcut files
VU#793496: Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency
Open Shortest Path First(OSPF)protocol implementations may improperly determine Link State Advertisement(LSA)recency for LSAs with MaxSequenceNumber. Attackers with the ability to transmit messages from a routing domain router may send specially crafted OSPF messages to poison routing tables within the domain. Continue reading VU#793496: Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency