BugTraq Latest Security Advisories

Syndicate content
The premier general security mailing list. Vulnerabilities are often announced here first, so check frequently!
Updated: 11 min 27 sec ago

MIUI Torch Open Vulnerability

September 17, 2014 - 6:15am

Posted by vuln on Sep 17

MIUI Torch Open Vulnerability
I. Summary
com.android.systemui is the corresponding package of MiuiSystemUI.apk, a MIUI system application that manages user

interface and other functions. When started by NFC tag, the torch in NFC mobile phone will be open automatically.
-----------------------------------------------------------------
II. Description
construct a message as follow:
D4 0F 14 61 6E 64 72 6F 69 64 2E 63 6F 6D 3A 70
6B 67 63 6F...
Categories:

MIUI Wifi Connection Message Vulnerability

September 17, 2014 - 6:04am

Posted by vuln on Sep 17

MIUI Wifi Connection Message Vulnerability

I. Summary
Wifi Connection Message is written to a NFC tag, which can be touched by a NFC mobile phone for connecting wireless AP

automatically. A logic flaw has been found in MIUI that is a Android ROM. The flaw can be used to turn on wifi, with
the

help of "wifihandover"(https://play.google.com/store/apps/details?id=net.endflow.apps.wifiho) or "NFC Tag

Assistant"(...
Categories:

Android Bluetooth Pairing Packet Processing Vulnerability(by wangzq from NCNIPC)

September 17, 2014 - 5:55am

Posted by vuln on Sep 17

I. Summary
Bluetooth Pairing Packet is written to a NFC tag, which can be touched by a NFC mobile phone for bluetooth pairing. A
logic flaw has been found in some

versions of Andorid mobile phone. The flaw can cause NFC phones'bluetooth turned on, regardless of whether the pairing
succeeds or not.
-----------------------------------------------------------------
II. Description
According to the NFC Bluetooth Simple Pairing Message...
Categories:

[CORE-2014-0006] - Delphi and C++ Builder VCL library Heap Buffer Overflow

September 17, 2014 - 5:45am

Posted by CORE Advisories Team on Sep 17

Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

Delphi and C++ Builder VCL library Heap Buffer Overflow

1. *Advisory Information*

Title: Delphi and C++ Builder VCL library Heap Buffer Overflow
Advisory ID: CORE-2014-0006
Advisory URL:
http://www.coresecurity.com/advisories/delphi-and-c-builder-vcl-library-heap-buffer-overflow
Date published: 2014-09-16
Date of last update: 2014-09-16
Vendors contacted: Embarcadero
Release...
Categories:

[SECURITY] [DSA 3026-1] dbus security update

September 17, 2014 - 5:36am

Posted by Florian Weimer on Sep 17

-------------------------------------------------------------------------
Debian Security Advisory DSA-3026-1 security () debian org
http://www.debian.org/security/ Florian Weimer
September 16, 2014 http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : dbus
CVE ID : CVE-2014-3635 CVE-2014-3636...
Categories:

[SECURITY] [DSA 3025-1] apt security update

September 17, 2014 - 5:25am

Posted by Salvatore Bonaccorso on Sep 17

-------------------------------------------------------------------------
Debian Security Advisory DSA-3025-1 security () debian org
http://www.debian.org/security/ Salvatore Bonaccorso
September 16, 2014 http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : apt
CVE ID : CVE-2014-0487 CVE-2014-0488...
Categories:

USB&WiFi Flash Drive v1.3 iOS - Code Execution Vulnerability

September 17, 2014 - 5:15am

Posted by Vulnerability Lab on Sep 17

Document Title:
===============
USB&WiFi Flash Drive 1.3 iOS - Code Execution Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1316

Release Date:
=============
2014-09-15

Vulnerability Laboratory ID (VL-ID):
====================================
1316

Common Vulnerability Scoring System:
====================================
9

Product & Service Introduction:...
Categories:

Osclass Security Advisory - Multiple XSS Vulnerabilities - CVE-2014-6280

September 17, 2014 - 5:05am

Posted by Onur Yilmaz on Sep 17

Information
------------
Advisory by Netsparker.
Name: XSS Vulnerability in OsClass
Affected Software : OsClass
Affected Versions: 3.4.1 and possibly below
Vendor Homepage : http://osclass.org/
Vulnerability Type : Cross-site Scripting
Severity : Critical
CVE-ID: CVE-2014-6280
Netsparker Advisory Reference : NS-14-030

Advisory URL
------------
https://www.netsparker.com/xss-vulnerabilities-in-osclass/

Description
-----------
Several cross-site...
Categories:

Osclass Security Advisory - LFI Vulnerability - CVE-2014-6308

September 17, 2014 - 4:56am

Posted by Onur Yilmaz on Sep 17

Information
-----------
Advisory by Netsparker.
Name : LFI Vulnerability in OsClass
Affected Software : OsClass
Affected Versions: 3.4.1 and possibly below
Vendor Homepage : http://osclass.org/
Vulnerability Type : Local File Inclusion
Severity : Critical
CVE-ID: CVE-2014-6308
Netsparker Advisory Reference : NS-14-031

Advisory URL
------------
https://www.netsparker.com/lfi-vulnerability-in-osclass/

Description
-----------
Local file inclusion...
Categories:

FreeBSD Security Advisory FreeBSD-SA-14:19.tcp

September 17, 2014 - 4:47am

Posted by FreeBSD Security Advisories on Sep 17

=============================================================================
FreeBSD-SA-14:19.tcp Security Advisory
The FreeBSD Project

Topic: Denial of Service in TCP packet processing

Category: core
Module: inet
Announced: 2014-09-16
Credits: Jonathan Looney (Juniper SIRT)
Affects: All supported versions...
Categories:

ESA-2014-091: EMC Documentum Content Server Multiple Privilege Escalation Vulnerabilities

September 16, 2014 - 4:45am

Posted by Security Alert on Sep 16

ESA-2014-091: EMC Documentum Content Server Multiple Privilege Escalation Vulnerabilities

EMC Identifier: ESA-2014-091

CVE Identifier: CVE-2014-4621, CVE-2014-4622

Severity Rating: CVSS v2 Base Score: See below for individual scores for each CVE

Affected products:

• All EMC Documentum Content Server versions of 7.1
• All EMC Documentum Content Server versions of 7.0
• All EMC Documentum Content Server versions of...
Categories:

Briefcase 4.0 iOS - Code Execution & File Include Vulnerability

September 15, 2014 - 11:45am

Posted by Vulnerability Lab on Sep 15

Document Title:
===============
Briefcase 4.0 iOS - Code Execution & File Include Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1319

Release Date:
=============
2014-09-11

Vulnerability Laboratory ID (VL-ID):
====================================
1319

Common Vulnerability Scoring System:
====================================
9.2

Product & Service Introduction:...
Categories:

Passwords^14 Norway - CFP

September 15, 2014 - 5:17am

Posted by Per Thorsheim on Sep 15

CALL FOR PAPERS AND TUTORIALS

PASSWORDS'14
passwordscon.org

The 7th International Conference on Passwords
8-10 December 2014
Trondheim,Norway

The Passwords conference was launched in 2010 as a response to the lack
of robustness and usability of current personal authentication practices
and...
Categories:

Open-Xchange Security Advisory 2014-09-15

September 15, 2014 - 5:06am

Posted by Martin Heiland on Sep 15

Product: OX App Suite
Vendor: Open-Xchange GmbH

Vulnerability type: Cross Site Scripting (CWE-80)
Vulnerable version: 7.6.0 and earlier
Vulnerable component: frontend
Fixed version: 7.4.2-rev33, 7.6.0-rev16
Report confidence: Confirmed
Solution status: Fixed by Vendor
Vendor notification: 2014-07-19
Solution date: 2014-08-26
Public disclosure: 2013-09-15
CVE reference: CVE-2014-5235
OX bug reference: 33620
CVSSv2: 5.7...
Categories:

Multiple Vulnerabilities with Aztech Modem Routers

September 15, 2014 - 4:56am

Posted by Federick Joe P Fajardo on Sep 15

PRODUCT DESCRIPTION

The Aztech ADSL family of modems/routes are shipped to residential and SOHO users that desires speed from 150-300mbps
rate. This modem/router also supports IEEE802.11b/g/n as a Wireless LAN Access point. The vulnerable model numbers are:
DSL5018EN (1T1R) (Shipped with Globe Telecom in the Philippines), DSL705E and DSL705EU.

Vendor reference: http://www.aztech.com/prod_adsl_dsl5018en_1t1r.html

1. Denial of Service (DoS)...
Categories:

Re: HttpFileServer 2.3.x Remote Command Execution

September 15, 2014 - 4:46am

Posted by danielelinguaglossa on Sep 15

A fix is now avaiable from vendor site

link: http://www.rejetto.com/hfs/download
Categories:

[security bulletin] HPSBOV03099 rev.1 - HP OpenVMS running OpenSSL, Remote Denial of Service (DoS) or Disclosure of Information

September 15, 2014 - 4:36am

Posted by security-alert on Sep 15

Note: the current version of the following document is available here:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c04426586

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c04426586
Version: 1

HPSBOV03099 rev.1 - HP OpenVMS running OpenSSL, Remote Denial of Service
(DoS) or Disclosure of Information

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release...
Categories: