[Forgot Password]
Login  Register Subscribe

23631

 
 

115084

 
 

97559

 
 

909

 
 

78730

 
 

109

Paid content will be excluded from the download.


Download | Alert*


oval:org.secpod.oval:def:108068
OpenVPN is a robust and highly flexible tunneling application that uses all of the encryption, authentication, and certification features of the OpenSSL library to securely tunnel IP networks over a single UDP or TCP port. It can use the Marcus Franz Xaver Johannes Oberhumer"s LZO library for compre ...

oval:org.secpod.oval:def:501184
OpenLDAP is an open source suite of Lightweight Directory Access Protocol applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap package contains configuration files, libraries, and docum ...

oval:org.secpod.oval:def:501191
OpenLDAP is an open source suite of Lightweight Directory Access Protocol applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap package contains configuration files, libraries, and docum ...

oval:org.secpod.oval:def:203038
OpenLDAP is an open source suite of Lightweight Directory Access Protocol applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap package contains configuration files, libraries, and docum ...

oval:org.secpod.oval:def:203017
OpenLDAP is an open source suite of Lightweight Directory Access Protocol applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap package contains configuration files, libraries, and docum ...

oval:org.secpod.oval:def:1300279
A vulnerability has been discovered and corrected in openldap: The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service by unbinding immediately after a search request, which triggers rwm_conn_destroy to f ...

oval:org.secpod.oval:def:106491
OpenLDAP is an open source suite of LDAP applications and development tools. LDAP is a set of protocols for accessing directory services over the Internet, similar to the way DNS information is propagated over the Internet. The openldap package contains configuration files, libraries, and documen ...

oval:org.secpod.oval:def:1500388
Updated openldap packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System base score, which gives a detailed severity rating, is available ...

oval:org.secpod.oval:def:108257
UnRTF is a command-line program written in C which converts documents in Rich Text Format to HTML, LaTeX, troff macros, and RTF itself. Converting to HTML, it supports a number of features of Rich Text Format: * Changes in the text"s font, size, weight , and slant * Underlines and strikethroughs * ...

oval:org.secpod.oval:def:23220
The host is installed with Oracle Java SE 6u85 and earlier, 7u72 and earlier or 8u25 and earlier and is prone to an unspecified vulnerability. A flaw is present in the application, which fails to handle unknown vectors related to Hotspot. Successful exploitation could allow attackers to affect confi ...

oval:org.secpod.oval:def:108236
The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote prog ...

oval:org.secpod.oval:def:108237
The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote prog ...

oval:org.secpod.oval:def:108253
The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote prog ...

oval:org.secpod.oval:def:20588
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to properly handle certain vectors. Successful exploitation allows remote attackers to bypass the Same Origin Policy or ca ...

oval:org.secpod.oval:def:20586
The host is installed with Google Chrome before 36.0.1985.125 and is prone to multiple integer overflow vulnerabilities. The flaws are present in the application, which fails to properly handle unknown vectors. Successful exploitation allows remote attackers to cause a denial of service or possibly ...

oval:org.secpod.oval:def:20587
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to properly handle certain vectors. Successful exploitation allows remote attackers to bypass the Same Origin Policy or ca ...

oval:org.secpod.oval:def:20584
The host is installed with Google Chrome before 36.0.1985.125 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to properly handle a crafted file. Successful exploitation allows remote attackers to bypass the Same Origin Policy.

oval:org.secpod.oval:def:20585
The host is installed with Google Chrome before 36.0.1985.125 and is prone to multiple integer overflow vulnerabilities. The flaws are present in the application, which fails to properly handle unknown vectors. Successful exploitation allows remote attackers to cause a denial of service or possibly ...

oval:org.secpod.oval:def:20583
The host is installed with Google Chrome before 36.0.1985.125 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to properly handle a crafted file. Successful exploitation allows remote attackers to bypass the Same Origin Policy.

oval:org.secpod.oval:def:16574
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to properly handle certain vectors related to forms, web workers and speech input elements. Successful exploitation allows ...

oval:org.secpod.oval:def:16572
The host is installed with Google Chrome before 32.0.1700.77 and is prone to unspecified security vulnerability. A flaw is present in the application, which fails to handle the closing of an untrusted signin confirm dialog. Successful exploitation allows attackers to trigger a sync with an arbitrary ...

oval:org.secpod.oval:def:16570
The host is installed with Google Chrome before 32.0.1700.77 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors related to the shutting down of a worker process. Successful exploitation allows attackers to cause a denial of service or po ...

oval:org.secpod.oval:def:16566
The host is installed with Google Chrome before 32.0.1700.77 and is prone to unspecified security vulnerability. A flaw is present in the application, which fails to handle the closing of an untrusted signin confirm dialog. Successful exploitation allows attackers to trigger a sync with an arbitrary ...

oval:org.secpod.oval:def:16564
The host is installed with Google Chrome before 32.0.1700.77 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors related to the shutting down of a worker process. Successful exploitation allows attackers to cause a denial of service or po ...

oval:org.secpod.oval:def:16568
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to properly handle certain vectors related to forms, web workers and speech input elements. Successful exploitation allows ...

oval:org.secpod.oval:def:17075
The host is installed with Google Chrome before 33.0.1750.152 and is prone to denial of service vulnerability. A flaw is present in the application, which fails to handle unknown vectors. Successful exploitation could allow attackers to cause a denial of service (memory corruption) or possibly have ...

oval:org.secpod.oval:def:17074
The host is installed with Google Chrome before 33.0.1750.152 and is prone to denial of service vulnerability. A flaw is present in the application, which fails to handle unknown vectors. Successful exploitation could allow attackers to cause a denial of service (memory corruption) or possibly have ...

oval:org.secpod.oval:def:17085
The host is missing a security update according to Google advisory. The update is required to fix multiple unspecified vulnerabilities. The flaws are present in the application, which fails to properly handle certain vectors. Successful exploitation could allow attackers to cause a denial of service ...

oval:org.secpod.oval:def:17084
The host is missing a security update according to Google advisory. The update is required to fix multiple unspecified vulnerabilities. The flaws are present in the application, which fails to properly handle certain vectors. Successful exploitation could allow attackers to cause a denial of service ...

oval:org.secpod.oval:def:17564
The host is missing a security update according to Google advisory. The update is required to fix multiple unspecified vulnerabilities. The flaws are present in the application, which fails to properly handle crafted data. Successful exploitation could allow attackers to crash the service.

oval:org.secpod.oval:def:16664
The host is installed with Google Chrome before 32.0.1700.102 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors involving a zero-size SVG image. Successful exploitation allows remote attackers to cause a denial of service or possibly ha ...

oval:org.secpod.oval:def:16665
The host is installed with Google Chrome before 32.0.1700.102 and is prone to memory corruption vulnerability. A flaw is present in the application, which fails to handle vectors that trigger incorrect handling of "popular pages.". Successful exploitation allows attackers to have unknown impact and ...

oval:org.secpod.oval:def:16668
The host is installed with Google Chrome before 32.0.1700.102 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors involving a zero-size SVG image. Successful exploitation allows remote attackers to cause a denial of service or possibly ha ...

oval:org.secpod.oval:def:16669
The host is installed with Google Chrome before 32.0.1700.102 and is prone to memory corruption vulnerability. A flaw is present in the application, which fails to handle vectors that trigger incorrect handling of "popular pages.". Successful exploitation allows attackers to have unknown impact and ...

oval:org.secpod.oval:def:16666
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain vectors related to memory. Successful exploitation allows attackers to cause denial of service.

oval:org.secpod.oval:def:17549
The host is missing a security update according to Google advisory. The update is required to fix multiple unspecified vulnerabilities. The flaws are present in the application, which fails to properly handle crafted data. Successful exploitation could allow attackers to crash the service.

oval:org.secpod.oval:def:17550
The host is installed with Google Chrome before 34.0.1847.116 and is prone to an universal cross site scripting vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation could allow attackers to inject arbitrary web script or HTML.

oval:org.secpod.oval:def:16670
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain vectors related to memory. Successful exploitation allows attackers to cause denial of service.

oval:org.secpod.oval:def:17535
The host is installed with Google Chrome before 34.0.1847.116 and is prone to an universal cross site scripting vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation could allow attackers to inject arbitrary web script or HTML.

oval:org.secpod.oval:def:27127
The host is installed with 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, or 2.3.x before 2.3.6 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to properly handle a small control channel packet. Successful exploitation allows remote attackers to cr ...

oval:org.secpod.oval:def:16576
The host is installed with Google Chrome before 32.0.1700.77 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors related to the shutting down of a worker process. Successful exploitation allows attackers to cause a denial of service or po ...

oval:org.secpod.oval:def:16578
The host is installed with Google Chrome before 32.0.1700.77 and is prone to unspecified security vulnerability. A flaw is present in the application, which fails to handle the closing of an untrusted signin confirm dialog. Successful exploitation allows attackers to trigger a sync with an arbitrary ...

oval:org.secpod.oval:def:16580
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to properly handle certain vectors related to forms, web workers and speech input elements. Successful exploitation allows ...

oval:org.secpod.oval:def:17096
The host is missing a security update according to Google advisory. The update is required to fix multiple unspecified vulnerabilities. The flaws are present in the application, which fails to properly handle certain vectors. Successful exploitation could allow attackers to cause a denial of service ...

oval:org.secpod.oval:def:17091
The host is installed with Google Chrome before 33.0.1750.152 and is prone to denial of service vulnerability. A flaw is present in the application, which fails to handle unknown vectors. Successful exploitation could allow attackers to cause a denial of service (memory corruption) or possibly have ...

oval:org.secpod.oval:def:16673
The host is installed with Google Chrome before 32.0.1700.102 and is prone to memory corruption vulnerability. A flaw is present in the application, which fails to handle vectors that trigger incorrect handling of "popular pages.". Successful exploitation allows attackers to have unknown impact and ...

oval:org.secpod.oval:def:16674
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain vectors related to memory. Successful exploitation allows attackers to cause denial of service.

oval:org.secpod.oval:def:16672
The host is installed with Google Chrome before 32.0.1700.102 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors involving a zero-size SVG image. Successful exploitation allows remote attackers to cause a denial of service or possibly ha ...

oval:org.secpod.oval:def:602244
It was discovered that FreeType did not properly handle some malformed inputs. This could allow remote attackers to cause a denial of service via crafted font files.

oval:org.secpod.oval:def:602402
Ralf Schlatterbeck discovered an information leak in roundup, a web-based issue tracking system. An authenticated attacker could use it to see sensitive details about other users, including their hashed password. After applying the update, which will fix the shipped templates, the site administrator ...

oval:org.secpod.oval:def:602574
It was discovered that redis, a persistent key-value database, did not properly protect redis-cli history files: they were created by default with world-readable permissions. Users and systems administrators may want to proactively change permissions on existing ~/rediscli_history files, instead of ...

oval:org.secpod.oval:def:702368
libssh: A tiny C SSH library libssh could be made to crash if it received specially crafted network traffic.

oval:org.secpod.oval:def:702337
xorg-server: X.Org X11 server - xorg-server-lts-trusty: X.Org X11 server Several security issues were fixed in the X.Org X server.

oval:org.secpod.oval:def:702318
openvpn: virtual private network software OpenVPN could be made to crash if it received specially crafted network traffic.

oval:org.secpod.oval:def:1300313
Multiple vulnerabilities has been discovered and corrected in python-django: Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the Vary: Cookie or Cache-Control header in responses, which allows remote attackers to obtain sensitive informa ...

oval:org.secpod.oval:def:107002
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle.

oval:org.secpod.oval:def:601216
Several vulnerabilities have been discovered in the chromium web browser. CVE-2013-6641 Atte Kettunen discovered a use-after-free issue in Blink/Webkit form elements. CVE-2013-6643 Joao Lucas Melo Brasio discovered a Google account information disclosure issue related to the one-click sign-on featur ...

oval:org.secpod.oval:def:601238
Several vulnerabilities have been discovered in the chromium web browser. CVE-2013-6653 Khalil Zhani discovered a use-after-free issue in chromium"s web contents color chooser. CVE-2013-6654 TheShow3511 discovered an issue in SVG handling. CVE-2013-6655 cloudfuzzer discovered a use-after-free issue ...

oval:org.secpod.oval:def:108030
pkcs11-helper is a library that simplifies the interaction with PKCS#11 providers for end-user applications using a simple API and optional OpenSSL engine. The library allows using multiple PKCS#11 providers at the same time, enumerating available token certificates, or selecting a certificate direc ...

oval:org.secpod.oval:def:1500584
Updated java-1.6.0-openjdk packages that fix various security issues and one bug are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System base scores, which give detailed ...

oval:org.secpod.oval:def:1500587
Updated java-1.6.0-openjdk packages that fix various security issues and one bug are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System base scores, which give detailed ...

oval:org.secpod.oval:def:1500589
Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, ...

oval:org.secpod.oval:def:1500623
An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when processed. A remote attacker, or an untrusted Java application or applet, could possibly use this flaw to execute arbitrary code wi ...

oval:org.secpod.oval:def:601708
A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS library, which can be exploited by a remote unauthenticated attacker to mount a denial of service against PolarSSL servers that offer GCM ciphersuites. Potentially clients are affected too if a malicious server decides to execute th ...

oval:org.secpod.oval:def:107251
PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their applications with as little hassle as possible.

oval:org.secpod.oval:def:203513
X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Multiple integer overflow flaws and out-of-bounds write flaws were found in the way the X.Org server calculated memory requireme ...

oval:org.secpod.oval:def:203511
X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Multiple integer overflow flaws and out-of-bounds write flaws were found in the way the X.Org server calculated memory requireme ...

oval:org.secpod.oval:def:203515
X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Multiple integer overflow flaws and out-of-bounds write flaws were found in the way the X.Org server calculated memory requireme ...

oval:org.secpod.oval:def:501470
X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Multiple integer overflow flaws and out-of-bounds write flaws were found in the way the X.Org server calculated memory requireme ...

oval:org.secpod.oval:def:501472
X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Multiple integer overflow flaws and out-of-bounds write flaws were found in the way the X.Org server calculated memory requireme ...

oval:org.secpod.oval:def:1600037
The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search ...

oval:org.secpod.oval:def:1600188
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service via a small control channel packet.

oval:org.secpod.oval:def:1200028
Multiple integer overflow flaws and out-of-bounds write flaws were found in the way the X.Org server calculated memory requirements for certain X11 core protocol and GLX extension requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server or, potentially, e ...

oval:org.secpod.oval:def:601869
Ilja van Sprundel of IOActive discovered several security issues in the X.org X server, which may lead to privilege escalation or denial of service.

oval:org.secpod.oval:def:601854
Dragana Damjanovic discovered that an authenticated client could crash an OpenVPN server by sending a control packet containing less than four bytes as payload.

oval:org.secpod.oval:def:601951
Michal Zalewski and Hanno Boeck discovered several vulnerabilities in unrtf, a RTF to other formats converter, leading to a denial of service or, potentially, the execution of arbitrary code.

oval:org.secpod.oval:def:601266
Several vulnerabilities were discovered in the chromium web browser. CVE-2014-1716 A cross-site scripting issue was discovered in the v8 javascript library. CVE-2014-1717 An out-of-bounds read issue was discovered in the v8 javascript library. CVE-2014-1718 Aaron Staple discovered an integer overflo ...

oval:org.secpod.oval:def:601273
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service.

oval:org.secpod.oval:def:108033
pkcs11-helper is a library that simplifies the interaction with PKCS#11 providers for end-user applications using a simple API and optional OpenSSL engine. The library allows using multiple PKCS#11 providers at the same time, enumerating available token certificates, or selecting a certificate direc ...

oval:org.secpod.oval:def:108061
OpenVPN is a robust and highly flexible tunneling application that uses all of the encryption, authentication, and certification features of the OpenSSL library to securely tunnel IP networks over a single UDP or TCP port. It can use the Marcus Franz Xaver Johannes Oberhumer"s LZO library for compre ...

oval:org.secpod.oval:def:107277
PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their applications with as little hassle as possible.

oval:org.secpod.oval:def:106379
OpenLDAP is an open source suite of LDAP applications and development tools. LDAP is a set of protocols for accessing directory services over the Internet, similar to the way DNS information is propagated over the Internet. The openldap package contains configuration files, libraries, and documen ...

oval:org.secpod.oval:def:106483
V8 is Google"s open source JavaScript engine. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. V8 implements ECMAScript as specified in ECMA-262, 3rd edition.

oval:org.secpod.oval:def:107463
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle.

oval:org.secpod.oval:def:107016
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle.

oval:org.secpod.oval:def:107019
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle.

oval:org.secpod.oval:def:107010
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle.

oval:org.secpod.oval:def:108199
OpenVPN is a robust and highly flexible tunneling application that uses all of the encryption, authentication, and certification features of the OpenSSL library to securely tunnel IP networks over a single UDP or TCP port. It can use the Marcus Franz Xaver Johannes Oberhumer"s LZO library for compre ...

oval:org.secpod.oval:def:1500573
Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, ...

oval:org.secpod.oval:def:1500368
Updated openldap packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System base score, which gives a detailed severity rating, ...

oval:org.secpod.oval:def:1500801
Updated xorg-x11-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, are a ...

oval:org.secpod.oval:def:1500807
Updated xorg-x11-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, are a ...

oval:org.secpod.oval:def:112081
xrdp provides a fully functional RDP server compatible with a wide range of RDP clients, including FreeRDP and Microsoft RDP client.

oval:org.secpod.oval:def:112112
xrdp provides a fully functional RDP server compatible with a wide range of RDP clients, including FreeRDP and Microsoft RDP client.

oval:org.secpod.oval:def:601284
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service.

oval:org.secpod.oval:def:24743
The host is installed with kernel in RHEL 7 and is prone to an unprivileged module load vulnerability. A flaw is present in the application, which fails to properly handle request_module() call. Successful exploitation could allow attackers to load any installed module.

oval:org.secpod.oval:def:112487
Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set i ...

oval:org.secpod.oval:def:702979
xdelta3: Diff utility which works with binary files xdelta3 could be made to crash or run programs if it opened a specially crafted file.

oval:org.secpod.oval:def:110091
Imlib 2 is a library that does image file loading and saving as well as rendering, manipulation, arbitrary polygon support, etc. It does ALL of these operations FAST. Imlib2 also tries to be highly intelligent about doing them, so writing naive programs can be done easily, without sacrificing speed. ...

oval:org.secpod.oval:def:602378
Stepan Golosunov discovered that xdelta3, a diff utility which works with binary files, is affected by a buffer overflow vulnerability within the main_get_appheader function, which may lead to the execution of arbitrary code.

oval:org.secpod.oval:def:110132
Imlib 2 is a library that does image file loading and saving as well as rendering, manipulation, arbitrary polygon support, etc. It does ALL of these operations FAST. Imlib2 also tries to be highly intelligent about doing them, so writing naive programs can be done easily, without sacrificing speed. ...

oval:org.secpod.oval:def:602450
Several vulnerabilities were discovered in imlib2, an image manipulation library. CVE-2014-9762 A segmentation fault could occur when opening GIFs without a colormap. CVE-2014-9763 Several divisions by zero, resulting in a program crash, could occur when handling PNM files. CVE-2014-9764 A segmentat ...

oval:org.secpod.oval:def:21291
The host is missing a patch containing a security fixes, which affects the following package(s): Java

oval:org.secpod.oval:def:20867
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to properly handle certain vectors. Successful exploitation allows remote attackers to cause a denial of service or possib ...

oval:org.secpod.oval:def:20868
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to properly handle certain vectors. Successful exploitation allows remote attackers to cause a denial of service or possib ...

oval:org.secpod.oval:def:20866
The host is installed with Google Chrome before 36.0.1985.143 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to properly handle vectors that trigger an unexpectedly long lifetime of a temporary object during method completion. Successful exploitation ...

oval:org.secpod.oval:def:20864
The host is installed with Google Chrome before 36.0.1985.143 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to properly handle vectors that trigger an unexpectedly long lifetime of a temporary object during method completion. Successful exploitation ...

oval:org.secpod.oval:def:20861
The host is installed with Google Chrome before 36.0.1985.143 and is prone to multiple unspecified vulnerabilities. The flaws are present in the application, which fails to properly handle unknown vectors. Successful exploitation allow attackers to cause a denial of service or possibly have other im ...

oval:org.secpod.oval:def:20862
The host is installed with Google Chrome before 36.0.1985.143 and is prone to multiple unspecified vulnerabilities. The flaws are present in the application, which fails to properly handle unknown vectors. Successful exploitation allow attackers to cause a denial of service or possibly have other im ...

oval:org.secpod.oval:def:601791
Several vulnerabilities were discovered in the chromium web browser. CVE-2014-3160 Christian Schneider discovered a same origin bypass issue in SVG file resource fetching. CVE-2014-3162 The Google Chrome development team addressed multiple issues with potential security impact for chromium 36.0.1985 ...

oval:org.secpod.oval:def:21814
The host is installed Ruby 1.9.3 and earlier or 2.x through 2.1.2 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to properly handle vectors that trigger a stack-based buffer overflow. Successful exploitation allows context-dependent attackers to ...

oval:org.secpod.oval:def:601950
Multiple vulnerabilities were discovered in the interpreter for the Ruby language: CVE-2014-4975 The encodes function in pack.c had an off-by-one error that could lead to a stack-based buffer overflow. This could allow remote attackers to cause a denial of service or arbitrary code execution. CVE-2 ...

oval:org.secpod.oval:def:203500
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Multiple denial of service flaws were found in the way the Ruby REXML XML parser performed expansion of parameter entities. A specially crafted XML d ...

oval:org.secpod.oval:def:702276
ruby2.0: Object-oriented scripting language - ruby2.1: Object-oriented scripting language - ruby1.9.1: Object-oriented scripting language - ruby1.8: Object-oriented scripting language Several security issues were fixed in Ruby.

oval:org.secpod.oval:def:501469
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Multiple denial of service flaws were found in the way the Ruby REXML XML parser performed expansion of parameter entities. A specially crafted XML d ...

oval:org.secpod.oval:def:1500811
Updated ruby packages that fix three security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, are available for each vul ...

oval:org.secpod.oval:def:601865
Simon McVittie discovered that the fix for CVE-2014-3636 was incorrect, as it did not fully address the underlying denial-of-service vector. This update starts the D-Bus daemon as root initially, so that it can properly raise its file descriptor count. In addition, this update reverts the auth_timeo ...

oval:org.secpod.oval:def:108051
D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility.

oval:org.secpod.oval:def:108190
D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility.

oval:org.secpod.oval:def:108235
D-BUS is a system for sending messages between applications. It is used both for the system wide message bus service, and as a per-user-login-session messaging facility.

oval:org.secpod.oval:def:108225
D-BUS is a system for sending messages between applications. It is used both for the system wide message bus service, and as a per-user-login-session messaging facility.

oval:org.secpod.oval:def:702312
dbus: simple interprocess messaging system DBus could be made to stop responding under certain conditions.

oval:org.secpod.oval:def:601872
Joshua Rogers discovered a format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz, a rich set of graph drawing tools. An attacker could use this flaw to cause graphviz to crash or possibly execute arbitrary code.

oval:org.secpod.oval:def:108150
A collection of tools for the manipulation and layout of graphs .

oval:org.secpod.oval:def:1200165
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vector, which are not properly handled in an error string.

oval:org.secpod.oval:def:1200080
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vector, which are not properly handled in an error string.

oval:org.secpod.oval:def:108015
A collection of tools for the manipulation and layout of graphs .

oval:org.secpod.oval:def:108016
A collection of tools for the manipulation and layout of graphs .

oval:org.secpod.oval:def:600919
A vulnerability has been found in the Apache HTTPD Server: CVE-2012-4557 A flaw was found when mod_proxy_ajp connects to a backend server that takes too long to respond. Given a specific configuration, a remote attacker could send certain requests, putting a backend server into an error state until ...

oval:org.secpod.oval:def:600967
Several vulnerabilities were discovered in the TLS/SSL protocol. This update addresses these protocol vulnerabilities in lighttpd. CVE-2009-3555 Marsh Ray, Steve Dispensa, and Martin Rex discovered that the TLS and SSLv3 protocols do not properly associate renegotiation handshakes with an existing c ...

oval:org.secpod.oval:def:600969
Juliano Rizzo and Thai Duong discovered a weakness in the TLS/SSL protocol when using compression. This side channel attack, dubbed "CRIME", allows eavesdroppers to gather information to recover the original plaintext in the protocol. This update to nginx disables SSL compression.

oval:org.secpod.oval:def:202572
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when CBC-mode ...

oval:org.secpod.oval:def:1500102
Updated openssl packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 5 and 6.The Red Hat Security Response Team has rated this update as having moderatesecurity impact. Common Vulnerability Scoring System base scores,which give detailed severity ratings, are avai ...

oval:org.secpod.oval:def:202626
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when CBC-mode ...

oval:org.secpod.oval:def:104792
The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols. This package contains Windows libraries and development tools.

oval:org.secpod.oval:def:1500085
Updated openssl packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderatesecurity impact. Common Vulnerability Scoring System base scores,which give detailed severity ratings, are ava ...

oval:org.secpod.oval:def:501010
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when CBC-mode ...

oval:org.secpod.oval:def:1600259
It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL or DTLS server as a padding ...

oval:org.secpod.oval:def:108091
D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility.

oval:org.secpod.oval:def:14112
The host is installed with Google Chrome before 27.0.1453.110 and is prone to memory corruption vulnerability. A flaw is present in the application, which fails to properly handle the Developer Tools API. Successful exploitation allows attackers to cause a denial of service or possibly have other im ...

oval:org.secpod.oval:def:14101
The host is installed with Google Chrome before 27.0.1453.110 and is prone to memory corruption vulnerability. A flaw is present in the application, which fails to properly handle the Developer Tools API. Successful exploitation allows attackers to cause a denial of service or possibly have other im ...

oval:org.secpod.oval:def:14113
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain vectors related to implementation of certain functions and other vectors. Successful exploitation allows ...

oval:org.secpod.oval:def:14110
The host is installed with Google Chrome before 27.0.1453.110 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors related to images. Successful exploitation allows attackers to cause a denial of service or possibly have other impact.

oval:org.secpod.oval:def:14111
The host is installed with Google Chrome before 27.0.1453.110 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors related to input. Successful exploitation allows attackers to cause a denial of service or possibly have other impact.

oval:org.secpod.oval:def:14114
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain vectors related to implementation of certain functions and other vectors. Successful exploitation allows ...

oval:org.secpod.oval:def:14109
The host is installed with Google Chrome before 27.0.1453.110 and is prone to multiple unspecified vulnerabilities. A flaw is present in the application, which fails to handle the HTML5 Audio implementation. Successful exploitation allows attackers to cause a denial of service or possibly have other ...

oval:org.secpod.oval:def:14107
The host is installed with Google Chrome before 27.0.1453.110 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors involving access to a database API by a worker process. Successful exploitation allows attackers to cause a denial of servic ...

oval:org.secpod.oval:def:14108
The host is installed with Google Chrome before 27.0.1453.110 and is prone to cross-origin namespace pollution vulnerability. A flaws are present in the application, which fails to handle certain unspecified vectors. Successful exploitation allows attackers to bypass the Same Origin Policy and trigg ...

oval:org.secpod.oval:def:14100
The host is installed with Google Chrome before 27.0.1453.110 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors related to input. Successful exploitation allows attackers to cause a denial of service or possibly have other impact.

oval:org.secpod.oval:def:14106
The host is installed with Google Chrome before 27.0.1453.110 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle the SVG implementation. Successful exploitation allows attackers to cause a denial of service or possibly have other impact.

oval:org.secpod.oval:def:601052
Several vulnerabilities have been discovered in the chromium web browser. CVE-2013-2855 The Developer Tools API in Chromium before 27.0.1453.110 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. CVE-2013-2856 Use-after-free vulnerabi ...

oval:org.secpod.oval:def:14088
The host is installed with Google Chrome before 27.0.1453.110 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors related to input. Successful exploitation allows attackers to cause a denial of service or possibly have other impact.

oval:org.secpod.oval:def:14083
The host is installed with Google Chrome before 27.0.1453.110 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle the SVG implementation. Successful exploitation allows attackers to cause a denial of service or possibly have other impact.

oval:org.secpod.oval:def:14085
The host is installed with Google Chrome before 27.0.1453.110 and is prone to cross-origin namespace pollution vulnerability. A flaws are present in the application, which fails to handle certain unspecified vectors. Successful exploitation allows attackers to bypass the Same Origin Policy and trigg ...

oval:org.secpod.oval:def:14084
The host is installed with Google Chrome before 27.0.1453.110 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors involving access to a database API by a worker process. Successful exploitation allows attackers to cause a denial of servic ...

oval:org.secpod.oval:def:14087
The host is installed with Google Chrome before 27.0.1453.110 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors related to images. Successful exploitation allows attackers to cause a denial of service or possibly have other impact.

oval:org.secpod.oval:def:14086
The host is installed with Google Chrome before 27.0.1453.110 and is prone to multiple unspecified vulnerabilities. A flaw is present in the application, which fails to handle the HTML5 Audio implementation. Successful exploitation allows attackers to cause a denial of service or possibly have other ...

oval:org.secpod.oval:def:14099
The host is installed with Google Chrome before 27.0.1453.110 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors related to images. Successful exploitation allows attackers to cause a denial of service or possibly have other impact.

oval:org.secpod.oval:def:14096
The host is installed with Google Chrome before 27.0.1453.110 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle vectors involving access to a database API by a worker process. Successful exploitation allows attackers to cause a denial of servic ...

oval:org.secpod.oval:def:14095
The host is installed with Google Chrome before 27.0.1453.110 and is prone to use-after-free vulnerability. A flaw is present in the application, which fails to handle the SVG implementation. Successful exploitation allows attackers to cause a denial of service or possibly have other impact.

oval:org.secpod.oval:def:14098
The host is installed with Google Chrome before 27.0.1453.110 and is prone to multiple unspecified vulnerabilities. A flaw is present in the application, which fails to handle the HTML5 Audio implementation. Successful exploitation allows attackers to cause a denial of service or possibly have other ...

oval:org.secpod.oval:def:14097
The host is installed with Google Chrome before 27.0.1453.110 and is prone to cross-origin namespace pollution vulnerability. A flaws are present in the application, which fails to handle certain unspecified vectors. Successful exploitation allows attackers to bypass the Same Origin Policy and trigg ...

oval:org.secpod.oval:def:14090
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain vectors related to implementation of certain functions and other vectors. Successful exploitation allows ...

oval:org.secpod.oval:def:106485
V8 is Google"s open source JavaScript engine. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. V8 implements ECMAScript as specified in ECMA-262, 3rd edition.

oval:org.secpod.oval:def:18732
The host is missing a security update according to Apple advisory, APPLE-SA-2014-05-21-1. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to properly handle crafted data. Successful exploitation could allow attackers to execute arbitrary ...

oval:org.secpod.oval:def:15726
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain elements and implementations. Successful exploitation allows attackers to cause denial of service.

oval:org.secpod.oval:def:601135
Several vulnerabilities have been discovered in the chromium web browser. CVE-2013-2906 Atte Kettunen of OUSPG discovered race conditions in Web Audio. CVE-2013-2907 Boris Zbarsky discovered an out-of-bounds read in window.prototype. CVE-2013-2908 Chamal de Silva discovered an address bar spoofing i ...

oval:org.secpod.oval:def:15707
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain elements and implementations. Successful exploitation allows attackers to cause denial of service.

oval:org.secpod.oval:def:400571
Update to Chromium 30.0.1599.66: - Easier searching by image - A number of new apps/extension APIs - Lots of under the hood changes for stability and performance - Security fixes: + CVE-2013-2906: Races in Web Audio + CVE-2013-2907: Out of bounds read in Window.prototype object + CVE-2013-2908: Addr ...

oval:org.secpod.oval:def:15694
The host is installed with Google Chrome before 30.0.1599.66 and is prone to memory corruption vulnerability. A flaw is present in the application, which fails to handle Google V8. Successful exploitation allows attackers to cause a denial of service.

oval:org.secpod.oval:def:15713
The host is installed with Google Chrome before 30.0.1599.66 and is prone to memory corruption vulnerability. A flaw is present in the application, which fails to handle Google V8. Successful exploitation allows attackers to cause a denial of service.

oval:org.secpod.oval:def:400570
Security and bugfix update to Chromium 31.0.1650.57 - Update to Chromium 31.0.1650.57: - Security Fixes: * CVE-2013-6632: Multiple memory corruption issues. - Update to Chromium 31.0.1650.48 Stable Channel update: - Security fixes: * CVE-2013-6621: Use after free related to speech input elements.. * ...

oval:org.secpod.oval:def:15812
The host is installed with Google Chrome before 30.0.1599.101 and is prone to use-after-free vulnerability. The flaws are present in the HTMLFormElement::prepareForSubmission function in core/html/HTMLFormElement.cpp in Blink, which fails to handle vectors related to submission for FORM elements. Su ...

oval:org.secpod.oval:def:15818
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain vectors related to some implementations and related to memory. Successful exploitation allows attackers ...

oval:org.secpod.oval:def:15819
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain vectors related to some implementations and related to memory. Successful exploitation allows attackers ...

oval:org.secpod.oval:def:15816
The host is installed with Google Chrome before 30.0.1599.101 and is prone to use-after-free vulnerability. The flaws are present in the HTMLFormElement::prepareForSubmission function in core/html/HTMLFormElement.cpp in Blink, which fails to handle vectors related to submission for FORM elements. Su ...

oval:org.secpod.oval:def:16055
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain vectors related to some implementations and related to memory. Successful exploitation allows attackers ...

oval:org.secpod.oval:def:16041
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain vectors related to some implementations and related to memory. Successful exploitation allows attackers ...

oval:org.secpod.oval:def:16073
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle certain vectors related to some implementations and related to memory. Successful exploitation allows attackers ...

oval:org.secpod.oval:def:601148
Several vulnerabilities have been discovered in the chromium web browser. CVE-2013-2931 The chrome 31 development team found various issues from internal fuzzing, audits, and other studies. CVE-2013-6621 Khalil Zhani discovered a use-after-free issue in speech input handling. CVE-2013-6622 cloudfuzz ...

oval:org.secpod.oval:def:400567
Chromium was updated to 31.0.1650.57: Stable channel update: - Security Fixes: * CVE-2013-6632: Multiple memory corruption issues. - Update to Chromium 31.0.1650.48 Stable Channel update: - Security fixes: * CVE-2013-6621: Use after free related to speech input elements.. * CVE-2013-6622: Use after ...

oval:org.secpod.oval:def:105875
Wireshark is a network traffic analyzer for Unix-ish operating systems. This package lays base for libpcap, a packet capture and filtering library, contains command-line utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged separately to GTK+ package.

oval:org.secpod.oval:def:13761
The host is installed with Wireshark 1.8.x before 1.8.7 and is prone to denial of service vulnerability. A flaw is present in the application, which uses incorrect integer data types. Successful exploitation allows attackers to cause heap memory corruption or NULL pointer dereference or application ...

oval:org.secpod.oval:def:13768
The host is installed with Wireshark 1.8.x before 1.8.7 and is prone to denial of service vulnerability. A flaw is present in the application, which uses incorrect integer data types. Successful exploitation allows attackers to cause heap memory corruption or NULL pointer dereference or application ...

oval:org.secpod.oval:def:501218
Wireshark is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network. Multiple flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the ...

oval:org.secpod.oval:def:601047
Multiple vulnerabilities were discovered in the dissectors for GTPv2, ASN.1 BER, PPP CCP, DCP ETSI, MPEG DSM-CC and Websocket, which could result in denial of service or the execution of arbitrary code. The oldstable distribution is not affected.

oval:org.secpod.oval:def:1600294
Two flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding ...

oval:org.secpod.oval:def:1500433
Updated wireshark packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, are avai ...

oval:org.secpod.oval:def:203233
Wireshark is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network. Multiple flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the ...

oval:org.secpod.oval:def:106187
Wireshark is a network traffic analyzer for Unix-ish operating systems. This package lays base for libpcap, a packet capture and filtering library, contains command-line utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged separately to GTK+ package.

oval:org.secpod.oval:def:501147
Wireshark, previously known as Ethereal, is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network. Two flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, exe ...

oval:org.secpod.oval:def:1600047
An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when processed. A remote attacker, or an untrusted Java application or applet, could possibly use this flaw to execute arbitrary code wi ...

oval:org.secpod.oval:def:501224
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when pro ...

oval:org.secpod.oval:def:501223
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when pro ...

oval:org.secpod.oval:def:501225
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when pro ...

oval:org.secpod.oval:def:501308
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when pro ...

oval:org.secpod.oval:def:501317
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when pro ...

oval:org.secpod.oval:def:203311
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when pro ...

oval:org.secpod.oval:def:203310
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when pro ...

oval:org.secpod.oval:def:203317
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when pro ...

oval:org.secpod.oval:def:203316
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when pro ...

oval:org.secpod.oval:def:1600146
An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when processed. A remote attacker, or an untrusted Java application or applet, could possibly use this flaw to execute arbitrary code wi ...

oval:org.secpod.oval:def:16027
The host is installed with Google Chrome before 31.0.1650.48 and is prone to an use-after-free vulnerability. The flaw is present in text INPUT element, which fails to properly handle the x-webkit-speech attribute. Successful exploitation allows remote attackers to cause a denial of service.

oval:org.secpod.oval:def:16059
The host is installed with Google Chrome before 31.0.1650.48 and is prone to an use-after-free vulnerability. The flaw is present in text INPUT element, which fails to properly handle the x-webkit-speech attribute. Successful exploitation allows remote attackers to cause a denial of service.

oval:org.secpod.oval:def:16043
The host is installed with Google Chrome before 31.0.1650.48 and is prone to an use-after-free vulnerability. The flaw is present in text INPUT element, which fails to properly handle the x-webkit-speech attribute. Successful exploitation allows remote attackers to cause a denial of service.

oval:org.secpod.oval:def:108247
cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, FTP ...

oval:org.secpod.oval:def:108238
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+passwo ...

oval:org.secpod.oval:def:108255
cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, FTP ...

oval:org.secpod.oval:def:108302
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+passwo ...

oval:org.secpod.oval:def:107896
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+passwo ...

oval:org.secpod.oval:def:108028
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+passwo ...

oval:org.secpod.oval:def:107983
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+passwo ...

oval:org.secpod.oval:def:601829
Symeon Paraschoudis discovered that the curl_easy_duphandle function in cURL, an URL transfer library, has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending, while performing a HTTP POST operation. This bug requires CURLOPT_COPYPOSTFIELDS and curl ...

oval:org.secpod.oval:def:108219
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+passwo ...

oval:org.secpod.oval:def:702280
curl: HTTP, HTTPS, and FTP client and client libraries curl could expose sensitive information over the network.

oval:org.secpod.oval:def:1200050
The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information. CRLF injection v ...

oval:org.secpod.oval:def:1500856
Updated xorg-x11-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, are availab ...

oval:org.secpod.oval:def:39515
The host is installed with Apple iTunes before 12.6 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to properly handle vectors involving use of the srand function. Successful exploitation could allow context-dependent attackers to defeat cryptograph ...

oval:org.secpod.oval:def:39504
The host is installed with Apple iTunes before 12.6 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to handle vectors involving use of the srand function. Successful exploitation allows attackers to defeat cryptographic protection mechanisms.

oval:org.secpod.oval:def:702486
tiff: Tag Image File Format library LibTIFF could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:702489
tiff: Tag Image File Format library Details: USN-2553-1 fixed vulnerabilities in LibTIFF. One of the security fixes caused a regression when saving certain TIFF files with a Predictor tag. The problematic patch has been temporarily backed out until a more complete fix is available. We apologize for ...

oval:org.secpod.oval:def:107952
PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their applications with as little hassle as possible.

oval:org.secpod.oval:def:107935
PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their applications with as little hassle as possible.

oval:org.secpod.oval:def:602114
William Robinet and Michal Zalewski discovered multiple vulnerabilities in the TIFF library and its tools, which may result in denial of service or the execution of arbitrary code if a malformed TIFF file is processed.

oval:org.secpod.oval:def:24752
The host is installed with libtiff in RHEL 5, 6 or 7 and is prone to a memory corruption vulnerability. A flaw is present in the application, which fails to properly handle crafted data. Successful exploitation could allow attackers to crash the service.

oval:org.secpod.oval:def:108349
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle.

oval:org.secpod.oval:def:702432
linux-ti-omap4: Linux kernel for OMAP4 Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:702438
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:108398
D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility.

oval:org.secpod.oval:def:108442
D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility.

oval:org.secpod.oval:def:108554
NX is a software suite which implements very efficient compression of the X11 protocol. This increases performance when using X applications over a network, especially a slow one. This package provides the core nx-X11 libraries customized for nxagent/x2goagent.

oval:org.secpod.oval:def:108558
NX is a software suite which implements very efficient compression of the X11 protocol. This increases performance when using X applications over a network, especially a slow one. This package provides the core nx-X11 libraries customized for nxagent/x2goagent.

oval:org.secpod.oval:def:702481
linux-lts-trusty: Linux hardware enablement kernel from Trusty Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:702474
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:23222
The host is installed with Oracle Java SE 5.0u75 and earlier, 6u85 and earlier, 7u72 and earlier or 8u25 and earlier and is prone to an unspecified vulnerability. A flaw is present in the application, which fails to handle unknown vectors related to Hotspot. Successful exploitation could allow attac ...

oval:org.secpod.oval:def:109119
The OpenJDK runtime environment.

oval:org.secpod.oval:def:108866
The OpenJDK runtime environment.

oval:org.secpod.oval:def:23221
The host is installed with Oracle Java SE 5.0u75 and earlier, 6u85 and earlier, 7u72 and earlier or 8u25 and earlier and is prone to an unspecified vulnerability. A flaw is present in the application, which fails to handle unknown vectors related to Hotspot. Successful exploitation could allow attac ...

oval:org.secpod.oval:def:23226
The host is installed with Oracle Java SE 5.0u75 and earlier, 6u85 and earlier, 7u72 and earlier or 8u25 and earlier and is prone to an unspecified vulnerability. A flaw is present in the application, which fails to handle unknown vectors related to Swing. Successful exploitation could allow attacke ...

oval:org.secpod.oval:def:23234
The host is installed with Oracle Java SE 5.0u75 and earlier, 6u85 and earlier, 7u72 and earlier or 8u25 and earlier and is prone to an unspecified vulnerability. A flaw is present in the application, which fails to handle unknown vectors related to Security. Successful exploitation could allow atta ...

oval:org.secpod.oval:def:23225
The host is installed with Oracle Java SE 5.0u75 and earlier, 6u85 and earlier, 7u72 and earlier or 8u25 and earlier and is prone to an unspecified vulnerability. A flaw is present in the application, which fails to handle vectors related to RMI. Successful exploitation could allow attackers to affe ...

oval:org.secpod.oval:def:23224
The host is installed with Oracle Java SE 6u85 and earlier, 7u72 and earlier or 8u25 and earlier and is prone to an unspecified vulnerability. A flaw is present in the application, which fails to handle vectors related to JAX-WS. Successful exploitation could allow attackers to affect confidentialit ...

oval:org.secpod.oval:def:23097
The host is installed with Wireshark 1.10.x before 1.10.12 or 1.12.x before 1.12.3 and is prone to a buffer underflow vulnerability. A flaw is present in the application, which fails to properly handle a crafted packet that is improperly handled during decryption of an SSL session. Successful exploi ...

oval:org.secpod.oval:def:23121
The host is installed with Wireshark 1.10.x before 1.10.12 or 1.12.x before 1.12.3 and is prone to a buffer underflow vulnerability. A flaw is present in the application, which fails to properly handle a crafted packet that is improperly handled during decryption of an SSL session. Successful exploi ...

oval:org.secpod.oval:def:601936
Multiple vulnerabilities were discovered in the dissectors/parsers for SSL/TLS and DEC DNA, which could result in denial of service.

oval:org.secpod.oval:def:602287
Tero Marttila discovered that the Debian packaging for smokeping installed it in such a way that the CGI implementation of Apache httpd passed additional arguments to the smokeping_cgi program, potentially leading to arbitrary code execution in response to crafted HTTP requests.

oval:org.secpod.oval:def:602485
Several vulnerabilities were discovered in tardiff, a tarball comparison tool. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-0857 Rainer Mueller and Florian Weimer discovered that tardiff is prone to shell command injections via shell meta-characters in ...

oval:org.secpod.oval:def:602311
Cédric Krier discovered a vulnerability in the server-side of Tryton, an application framework written in Python. An aunthenticated malicious user can write arbitrary values in record fields due missed checks of access permissions when multiple records are written. The oldstable distribut ...

oval:org.secpod.oval:def:602090
Kostya Kortchinsky of the Google Security Team discovered a flaw in the DER parser used to decode SSL/TLS certificates in suricata. A remote attacker can take advantage of this flaw to cause suricata to crash.

oval:org.secpod.oval:def:108358
PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their applications with as little hassle as possible.

oval:org.secpod.oval:def:24197
The host is installed with Google Chrome before 42.0.2311.90 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24198
The host is installed with Google Chrome before 42.0.2311.90 and is prone to an out-of-bounds vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24199
The host is installed with Google Chrome before 42.0.2311.90 and is prone to an out-of-bounds vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24192
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to bypass cross origin vulnerability.

oval:org.secpod.oval:def:24193
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to bypass cross origin vulnerability.

oval:org.secpod.oval:def:24194
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to bypass cross origin.

oval:org.secpod.oval:def:24195
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to bypass cross origin.

oval:org.secpod.oval:def:24196
The host is installed with Google Chrome before 42.0.2311.90 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24200
The host is installed with Google Chrome before 42.0.2311.90 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24201
The host is installed with Google Chrome before 42.0.2311.90 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24202
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a tap-jacking vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24203
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a tap-jacking vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24204
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a type-confusion vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24205
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a type-confusion vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24899
The host is installed with Google Chrome before 42.0.2311.135 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a MutationObserver object that is not currently registered. Successful exploitation could allow attackers to cause a denial of se ...

oval:org.secpod.oval:def:24464
The host is installed with Google Chrome before 42.0.2311.135 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a MutationObserver object that is not currently registered. Successful exploitation could allow attackers to cause a denial of se ...

oval:org.secpod.oval:def:24466
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24900
The host is installed with Google Chrome before 42.0.2311.135 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a MutationObserver object that is not currently registered. Successful exploitation could allow attackers to cause a denial of se ...

oval:org.secpod.oval:def:24901
The host is installed with Google Chrome before 42.0.2311.135 and is prone to multiple unspecified vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation could allow attackers to cause a denial of service or possibly have other impac ...

oval:org.secpod.oval:def:24902
The host is installed with Google Chrome before 42.0.2311.135 and is prone to multiple unspecified vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation could allow attackers to cause a denial of service or possibly have other impac ...

oval:org.secpod.oval:def:24903
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24904
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:702548
oxide-qt: Web browser engine library for Qt Several security issues were fixed in Oxide.

oval:org.secpod.oval:def:24216
The host is installed with Google Chrome before 42.0.2311.90 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24217
The host is installed with Google Chrome before 42.0.2311.90 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24218
The host is installed with Google Chrome and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24219
The host is installed with Google Chrome and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24206
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a HSTS bypass vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:24207
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a HSTS bypass vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:602072
Several vulnerabilities were discovered in the chromium web browser. CVE-2015-1243 Saif El-Sherei discovered a use-after-free issue. CVE-2015-1250 The chrome 42 team found and fixed multiple issues during internal auditing.

oval:org.secpod.oval:def:24917
The host is installed with Google Chrome before 43.0.2357.65 and is prone to a denial of service vulnerability. A flaw is present in the application, which does not properly handle an insufficient number of values in an feColorMatrix filter. Successful exploitation could allow attackers to cause a d ...

oval:org.secpod.oval:def:24918
The host is installed with Google Chrome before 43.0.2357.65 and is prone to a denial of service vulnerability. A flaw is present in the application, which does not properly handle an insufficient number of values in an feColorMatrix filter. Successful exploitation could allow attackers to cause a d ...

oval:org.secpod.oval:def:24919
The host is installed with Google Chrome before 43.0.2357.65 and is prone to a denial of service vulnerability. A flaw is present in the libvpx code, which was not built with an appropriate --size-limit value. Successful exploitation could allow attackers to trigger a negative value for a size field ...

oval:org.secpod.oval:def:24910
The host is installed with Google Chrome before 43.0.2357.65 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a crafted document. Successful exploitation could allow attackers to cause a denial of service or possibly have unspecified other ...

oval:org.secpod.oval:def:24911
The host is installed with Google Chrome before 43.0.2357.65 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to handle vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircula ...

oval:org.secpod.oval:def:24912
The host is installed with Google Chrome before 43.0.2357.65 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to handle vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircula ...

oval:org.secpod.oval:def:24913
The host is installed with Google Chrome before 43.0.2357.65 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to handle crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions. Success ...

oval:org.secpod.oval:def:24914
The host is installed with Google Chrome before 43.0.2357.65 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to handle crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions. Success ...

oval:org.secpod.oval:def:24915
The host is installed with Google Chrome before 43.0.2357.65 and is prone to a security bypass vulnerability. A flaw is present in the application, which enables the inheritance of the designMode attribute. Successful exploitation could allow attackers to bypass the Same Origin Policy.

oval:org.secpod.oval:def:24916
The host is installed with Google Chrome before 43.0.2357.65 and is prone to a security bypass vulnerability. A flaw is present in the application, which enables the inheritance of the designMode attribute. Successful exploitation could allow attackers to bypass the Same Origin Policy.

oval:org.secpod.oval:def:24906
The host is installed with Google Chrome before 43.0.2357.65 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a crafted document. Successful exploitation could allow attackers to execute arbitrary code.

oval:org.secpod.oval:def:24907
The host is installed with Google Chrome before 43.0.2357.65 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle stop action for an audio track. Successful exploitation could allow attackers to cause a denial of service (heap memory corruption ...

oval:org.secpod.oval:def:24908
The host is installed with Google Chrome before 43.0.2357.65 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle stop action for an audio track. Successful exploitation could allow attackers to cause a denial of service (heap memory corruption ...

oval:org.secpod.oval:def:24909
The host is installed with Google Chrome before 43.0.2357.65 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a crafted document. Successful exploitation could allow attackers to cause a denial of service or possibly have unspecified other ...

oval:org.secpod.oval:def:24905
The host is installed with Google Chrome before 43.0.2357.65 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a crafted document. Successful exploitation could allow attackers to execute arbitrary code.

oval:org.secpod.oval:def:109574
libvpx provides the VP8 SDK, which allows you to integrate your applications with the VP8 video codec, a high quality, royalty free, open source codec deployed on millions of computers and devices worldwide.

oval:org.secpod.oval:def:109533
libvpx provides the VP8 SDK, which allows you to integrate your applications with the VP8 video codec, a high quality, royalty free, open source codec deployed on millions of computers and devices worldwide.

oval:org.secpod.oval:def:24920
The host is installed with Google Chrome before 43.0.2357.65 and is prone to a denial of service vulnerability. A flaw is present in the libvpx code, which was not built with an appropriate --size-limit value. Successful exploitation could allow attackers to trigger a negative value for a size field ...

oval:org.secpod.oval:def:24921
The host is installed with Google Chrome before 43.0.2357.65 and is prone to a denial of service vulnerability. A flaw is present in the application, which does not properly initialize memory. Successful exploitation could allow attackers to cause a denial of service or possibly have unspecified oth ...

oval:org.secpod.oval:def:24922
The host is installed with Google Chrome before 43.0.2357.65 and is prone to a denial of service vulnerability. A flaw is present in the application, which does not properly initialize memory. Successful exploitation could allow attackers to cause a denial of service or possibly have unspecified oth ...

oval:org.secpod.oval:def:24923
The host is installed with Google Chrome before 43.0.2357.65 and is prone to multiple use-after-free vulnerabilities. The flaws are present in the application, which fails to handle a crafted JavaScript code that executes upon completion of a getUserMedia request. Successful exploitation could allow ...

oval:org.secpod.oval:def:24924
The host is installed with Google Chrome before 43.0.2357.65 and is prone to multiple use-after-free vulnerabilities. The flaws are present in the application, which fails to handle a crafted JavaScript code that executes upon completion of a getUserMedia request. Successful exploitation could allow ...

oval:org.secpod.oval:def:602116
Several vulnerabilities were discovered in the chromium web browser. CVE-2015-1251 SkyLined discovered a use-after-free issue in speech recognition. CVE-2015-1252 An out-of-bounds write issue was discovered that could be used to escape from the sandbox. CVE-2015-1253 A cross-origin bypass issue was ...

oval:org.secpod.oval:def:602232
It was discovered that the International Components for Unicode library mishandles converter names starting with x- , which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted file.

oval:org.secpod.oval:def:25569
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an uninitialized memory read vulnerability. A flaw is present in the application, which fails to properly handle converter names with initial x- substrings. Successful exploitation could allow remote attackers to crash the ...

oval:org.secpod.oval:def:25564
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to properly handle crafted data. Successful exploitation could allow remote attackers to crash the service or cause unspecified impact.

oval:org.secpod.oval:def:25565
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to properly handle crafted data. Successful exploitation could allow remote attackers to crash the service or cause unspecified impact.

oval:org.secpod.oval:def:25566
The host is installed with Google Chrome before 44.0.2403.89 and is prone to a heap-based buffer overflow vulnerability. A flaw is present in the application, which fails to properly handle a crafted PDF document that triggers a large memory allocation. Successful exploitation could allow remote att ...

oval:org.secpod.oval:def:25567
The host is installed with Google Chrome before 44.0.2403.89 and is prone to a heap-based buffer overflow vulnerability. A flaw is present in the application, which fails to properly handle a crafted PDF document that triggers a large memory allocation. Successful exploitation could allow remote att ...

oval:org.secpod.oval:def:25568
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an uninitialized memory read vulnerability. A flaw is present in the application, which fails to properly handle converter names with initial x- substrings. Successful exploitation could allow remote attackers to crash the ...

oval:org.secpod.oval:def:602177
Several vulnerabilities were discovered in the chromium web browser. CVE-2015-1266 Intended access restrictions could be bypassed for certain URLs like chrome://gpu. CVE-2015-1267 A way to bypass the Same Origin Policy was discovered. CVE-2015-1268 Mariusz Mlynski also discovered a way to bypass the ...

oval:org.secpod.oval:def:25558
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to properly handle an abort action before a certain write operation. Successful exploitation could allow remote attackers to crash the servi ...

oval:org.secpod.oval:def:25559
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to properly handle an abort action before a certain write operation. Successful exploitation could allow remote attackers to crash the servi ...

oval:org.secpod.oval:def:25561
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an arbitrary code execution vulnerability. A flaw is present in the application, which fails to properly handle a crafted file. Successful exploitation could allow remote attackers to execute arbitrary code.

oval:org.secpod.oval:def:25562
The host is installed with Google Chrome before 44.0.2403.89 and is prone to a heap-based buffer overflow vulnerability. A flaw is present in the application, which fails to properly handle an invalid JPEG2000 data in a PDF document. Successful exploitation could allow remote attackers to crash the ...

oval:org.secpod.oval:def:25563
The host is installed with Google Chrome before 44.0.2403.89 and is prone to a heap-based buffer overflow vulnerability. A flaw is present in the application, which fails to properly handle an invalid JPEG2000 data in a PDF document. Successful exploitation could allow remote attackers to crash the ...

oval:org.secpod.oval:def:25560
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an arbitrary code execution vulnerability. A flaw is present in the application, which fails to properly handle a crafted file. Successful exploitation could allow remote attackers to execute arbitrary code.

oval:org.secpod.oval:def:25548
The host is installed with Google Chrome before 44.0.2403.89 and is prone to a content security bypass vulnerability. A flaw is present in the application, which fails to properly determine the V8 context of a microtask. Successful exploitation could allow attackers to bypass Content Security Policy ...

oval:org.secpod.oval:def:25549
The host is installed with Google Chrome before 44.0.2403.89 and is prone to a content security bypass vulnerability. A flaw is present in the application, which fails to properly determine the V8 context of a microtask. Successful exploitation could allow attackers to bypass Content Security Policy ...

oval:org.secpod.oval:def:25550
The host is installed with Google Chrome before 44.0.2403.89 and is prone to a memory corruption vulnerability. A flaw is present in the application, which fails to properly handle crafted serialized data. Successful exploitation could allow attackers to crash the service.

oval:org.secpod.oval:def:25551
The host is installed with Google Chrome before 44.0.2403.89 and is prone to a memory corruption vulnerability. A flaw is present in the application, which fails to properly handle crafted serialized data. Successful exploitation could allow attackers to crash the service.

oval:org.secpod.oval:def:25552
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an integer overflow vulnerability. A flaw is present in the application, which fails to properly handle large height and stride values. Successful exploitation could allow attackers to crash the service (heap-based buffer o ...

oval:org.secpod.oval:def:25553
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an integer overflow vulnerability. A flaw is present in the application, which fails to properly handle large height and stride values. Successful exploitation could allow attackers to crash the service(heap-based buffer ov ...

oval:org.secpod.oval:def:25554
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an URL spoofing vulnerability. A flaw is present in the application, which fails to ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page. Successful exploitation could allow remote att ...

oval:org.secpod.oval:def:25555
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an URL spoofing vulnerability. A flaw is present in the application, which fails to ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page. Successful exploitation could allow remote att ...

oval:org.secpod.oval:def:25556
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to perform certain validity checks for accessibility-tree data structures. Successful exploitation could allow remote attackers to crash the ...

oval:org.secpod.oval:def:25557
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to perform certain validity checks for accessibility-tree data structures. Successful exploitation could allow remote attackers to crash the ...

oval:org.secpod.oval:def:25532
The host is installed with Google Chrome before 44.0.2403.89 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation could allow attackers to crash the service.

oval:org.secpod.oval:def:25533
The host is installed with Google Chrome before 44.0.2403.89 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation could allow attackers to crash the service.

oval:org.secpod.oval:def:25534
The host is installed with Google Chrome before 44.0.2403.89 and is prone to a man-in-the-middle attack vulnerability. A flaw is present in the application, which fails to use an HTTPS session for downloading a Hunspell dictionary. Successful exploitation could allow attackers to produce unspecified ...

oval:org.secpod.oval:def:25535
The host is installed with Google Chrome before 44.0.2403.89 and is prone to a man-in-the-middle attack vulnerability. A flaw is present in the application, which fails to use an HTTPS session for downloading a Hunspell dictionary. Successful exploitation could allow attackers to produce unspecified ...

oval:org.secpod.oval:def:25547
The host is installed with Google Chrome before 44.0.2403.89 and is prone to multiple use-after-free vulnerabilities. The flaws are present in the application, which fails to properly handle a crafted PDF document. Successful exploitation could allow attackers to crash the service.

oval:org.secpod.oval:def:25536
The host is installed with Google Chrome before 44.0.2403.89 and is prone to a same origin bypass vulnerability. A flaw is present in the application, which improperly limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type. Successful exploita ...

oval:org.secpod.oval:def:25537
The host is installed with Google Chrome before 44.0.2403.89 and is prone to a same origin bypass vulnerability. A flaw is present in the application, which improperly limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type. Successful exploita ...

oval:org.secpod.oval:def:25538
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an universal XSS vulnerability. A flaw is present in the application, which fails to properly apply a certain V8 context restriction. Successful exploitation could allow attackers to inject arbitrary web script.

oval:org.secpod.oval:def:25539
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an universal XSS vulnerability. A flaw is present in the application, which fails to properly apply a certain V8 context restriction. Successful exploitation could allow attackers to inject arbitrary web script.

oval:org.secpod.oval:def:25540
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to properly choose a truncation function. Successful exploitation could allow attackers to disclose sensitive information.

oval:org.secpod.oval:def:25541
The host is installed with Google Chrome before 44.0.2403.89 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to properly choose a truncation function. Successful exploitation could allow attackers to disclose sensitive information.

oval:org.secpod.oval:def:25546
The host is installed with Google Chrome before 44.0.2403.89 and is prone to multiple use-after-free vulnerabilities. The flaws are present in the application, which fails to properly handle a crafted PDF document. Successful exploitation could allow attackers to crash the service.

oval:org.secpod.oval:def:702482
linux-lts-utopic: Linux hardware enablement kernel from Utopic Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:702475
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:702573
openldap: OpenLDAP utilities OpenLDAP could be made to crash if it received specially crafted network traffic.

oval:org.secpod.oval:def:602021
Multiple vulnerabilities were found in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. CVE-2013-4449 Michael Vishchers from Seven Principles AG discovered a denial of service vulnerability in slapd, the directory server implementation. When the server is configured to u ...

oval:org.secpod.oval:def:1200116
Use of uninitialized memory was reported in in libtiff.

oval:org.secpod.oval:def:109163
The libtiff package contains a library of functions for manipulating TIFF image format files. TIFF is a widely used file format for bitmapped images. TIFF files usually end in the .tif extension and they are often quite large. The libtiff package should be installed if you need to manipulate TIFF f ...

oval:org.secpod.oval:def:109149
The libtiff package contains a library of functions for manipulating TIFF image format files. TIFF is a widely used file format for bitmapped images. TIFF files usually end in the .tif extension and they are often quite large. The libtiff package should be installed if you need to manipulate TIFF f ...

oval:org.secpod.oval:def:601968
Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation. CVE-2013-7421 / CVE-2014-9644 It was discovered that the Crypto API allowed unprivileged users to load arbitrary kernel modules. A local user can use this ...

oval:org.secpod.oval:def:1501044
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate ...

oval:org.secpod.oval:def:1501048
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate ...

oval:org.secpod.oval:def:1501049
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate ...

oval:org.secpod.oval:def:1501052
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate ...

oval:org.secpod.oval:def:501609
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extend ...

oval:org.secpod.oval:def:26778
The host is installed with LibreOffice before 4.3.7, 4.4.x before 4.4.2 or Apache OpenOffice before 4.1.2 and is prone to an out-of-bounds write vulnerability. A flaw is present in the application, which fails to handle a crafted HWP document. Successful exploitation could allow attackers to crash ...

oval:org.secpod.oval:def:1501089
LibreOffice is an Open Source, community-developed, office productivity suite. It includes the key desktop applications, such as a word processor, spreadsheet, presentation manager, formula editor and drawing program, with a user interface and feature set similar to other office suites. Sophisticate ...

oval:org.secpod.oval:def:702520
libreoffice: Office productivity suite LibreOffice could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:26859
The host is installed with LibreOffice before 4.3.7, 4.4.x before 4.4.2 or Apache OpenOffice before 4.1.2 and is prone to an out-of-bounds write vulnerability. A flaw is present in the application, which fails to handle a crafted HWP document. Successful exploitation could allow attackers to crash t ...

oval:org.secpod.oval:def:602062
It was discovered that missing input sanitising in Libreoffice"s filter for HWP documents may result in the execution of arbitrary code if a malformed document is opened.

oval:org.secpod.oval:def:108804
LibreOffice is an Open Source, community-developed, office productivity suite. It includes the key desktop applications, such as a word processor, spreadsheet, presentation manager, formula editor and drawing program, with a user interface and feature set similar to other office suites. Sophisticate ...

oval:org.secpod.oval:def:204224
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extend ...

oval:org.secpod.oval:def:108835
LibreOffice is an Open Source, community-developed, office productivity suite. It includes the key desktop applications, such as a word processor, spreadsheet, presentation manager, formula editor and drawing program, with a user interface and feature set similar to other office suites. Sophisticate ...

oval:org.secpod.oval:def:501670
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. It was found that the QEMU"s websocket frame decoder processed incoming frames without limiting resources used to process the ...

oval:org.secpod.oval:def:602373
Several vulnerabilities have been fixed in the GNU C Library, eglibc. The CVE-2015-7547 vulnerability listed below is considered to have critical impact. CVE-2014-8121 Robin Hack discovered that the nss_files database did not correctly implement enumeration interleaved with name-based or ID-based lo ...

oval:org.secpod.oval:def:108696
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system , including a processor and various peripherials. It can be used to launch differe ...

oval:org.secpod.oval:def:110172
The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important sets ...

oval:org.secpod.oval:def:1501202
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. It was found that the QEMU"s websocket frame decoder processed incoming frames without limiting resources used to process the ...

oval:org.secpod.oval:def:25177
The host is installed with qemu-kvm on Red Hat Enterprise Linux 7 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to limit resources used to process the header and payload of an incoming frame. Successful exploitation could allow attackers to cras ...

oval:org.secpod.oval:def:203754
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. It was found that the QEMU"s websocket frame decoder processed incoming frames without limiting resources used to process the ...

oval:org.secpod.oval:def:203648
The kernel packages contain the Linux kernel, the core of any Linux operating system. * It was found that the Linux kernel"s implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access o ...

oval:org.secpod.oval:def:501583
The kernel packages contain the Linux kernel, the core of any Linux operating system. * It was found that the Linux kernel"s implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access o ...

oval:org.secpod.oval:def:1501101
The libxml2 library is a development toolbox providing the implementation of various XML standards. A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when process ...

oval:org.secpod.oval:def:501615
The libxml2 library is a development toolbox providing the implementation of various XML standards. A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, co ...

oval:org.secpod.oval:def:702847
libxml2: GNOME XML library Several security issues were fixed in libxml2.

oval:org.secpod.oval:def:204237
The libxml2 library is a development toolbox providing the implementation of various XML standards. A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, co ...

oval:org.secpod.oval:def:109373
wpa_supplicant is a WPA Supplicant for Linux, BSD and Windows with support for WPA and WPA2 . Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association ...

oval:org.secpod.oval:def:1501035
The wpa_supplicant package contains an 802.1X Supplicant with support for WEP, WPA, WPA2 , and various EAP authentication methods. It implements key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver. A ...

oval:org.secpod.oval:def:702517
wpa: client support for WPA and WPA2 wpa_supplicant could be made to crash, expose memory, or run programs if it received specially crafted network traffic.

oval:org.secpod.oval:def:108789
wpa_supplicant is a WPA Supplicant for Linux, BSD and Windows with support for WPA and WPA2 . Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association ...

oval:org.secpod.oval:def:602065
The Google security team and the smart hardware research group of Alibaba security team discovered a flaw in how wpa_supplicant used SSID information when creating or updating P2P peer entries. A remote attacker can use this flaw to cause wpa_supplicant to crash, expose memory contents, and potentia ...

oval:org.secpod.oval:def:108854
wpa_supplicant is a WPA Supplicant for Linux, BSD and Windows with support for WPA and WPA2 . Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association ...

oval:org.secpod.oval:def:108686
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:108681
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:108760
The kernel package contains the Linux kernel , the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc.

oval:org.secpod.oval:def:108752
The kernel meta package

oval:org.secpod.oval:def:602074
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2014-8159 It was found that the Linux kernel"s InfiniBand/RDMA subsystem did not properly sanitize input parameters while registering memory regions f ...

oval:org.secpod.oval:def:108802
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:108817
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:24343
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:502083
The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a particular network interface or on all interfaces. The following packages have been upgraded to a later upstream version: tcpdump . Security Fix: * Mu ...

oval:org.secpod.oval:def:108574
Tcpdump is a command-line tool for monitoring network traffic. Tcpdump can capture and display the packet headers on a particular network interface or on all interfaces. Tcpdump can display all of the packet headers, or just the ones that match particular criteria. Install tcpdump if you need a prog ...

oval:org.secpod.oval:def:601999
Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service or, potentially, execution of arbitrary code.

oval:org.secpod.oval:def:702519
tcpdump: command-line network traffic analyzer tcpdump could be made to crash or run programs if it received specially crafted network traffic.

oval:org.secpod.oval:def:108705
Tcpdump is a command-line tool for monitoring network traffic. Tcpdump can capture and display the packet headers on a particular network interface or on all interfaces. Tcpdump can display all of the packet headers, or just the ones that match particular criteria. Install tcpdump if you need a prog ...

oval:org.secpod.oval:def:23703
The host is installed with Wireshark 1.10.x before 1.10.13 or 1.12.x before 1.12.4 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to properly handle an invalid Interface Statistics Block (ISB) interface ID in a crafted packet. Successful exploita ...

oval:org.secpod.oval:def:23702
The host is installed with Wireshark 1.10.x before 1.10.13 or 1.12.x before 1.12.4 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to properly handle a crafted packet during decompression. Successful exploitation allows remote attackers to cause a ...

oval:org.secpod.oval:def:23709
The host is installed with Wireshark 1.10.x before 1.10.13 or 1.12.x before 1.12.4 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to properly handle an invalid Interface Statistics Block (ISB) interface ID in a crafted packet. Successful exploita ...

oval:org.secpod.oval:def:23708
The host is installed with Wireshark 1.10.x before 1.10.13 or 1.12.x before 1.12.4 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to properly handle a crafted packet during decompression. Successful exploitation allows remote attackers to cause a ...

oval:org.secpod.oval:def:501602
Wireshark, previously known as Ethereal, is a network protocol analyzer, which is used to capture and browse the traffic running on a computer network. Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or op ...

oval:org.secpod.oval:def:501693
The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump f ...

oval:org.secpod.oval:def:1501092
Multiple vulnerabilities were discovered in the dissectors/parsers for WCP, pcapng and TNEF, which could result in denial of service.

oval:org.secpod.oval:def:23704
The host is installed with Wireshark 1.10.x before 1.10.13 or 1.12.x before 1.12.4 and is prone to an integer overflow vulnerability. A flaw is present in the application, which fails to properly handle a crafted length field in a packet. Successful exploitation allows remote attackers to cause a de ...

oval:org.secpod.oval:def:1200152
Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file

oval:org.secpod.oval:def:602023
Multiple vulnerabilities were discovered in the dissectors/parsers for WCP, pcapng and TNEF, which could result in denial of service.

oval:org.secpod.oval:def:23710
The host is installed with Wireshark 1.10.x before 1.10.13 or 1.12.x before 1.12.4 and is prone to an integer overflow vulnerability. A flaw is present in the application, which fails to properly handle a crafted length field in a packet. Successful exploitation allows remote attackers to cause a de ...

oval:org.secpod.oval:def:204268
Wireshark, previously known as Ethereal, is a network protocol analyzer, which is used to capture and browse the traffic running on a computer network. Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or op ...

oval:org.secpod.oval:def:204218
The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump f ...

oval:org.secpod.oval:def:1501221
The remote host is missing a patch containing a security fix, which affects the following package(s): wireshark

oval:org.secpod.oval:def:602263
Several vulnerabilities were discovered in Wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-2213 SQL Injection allowed a remote attacker to compromise the site. CVE-2015-5622 The robustness of the shortcodes HTML tags filter ...

oval:org.secpod.oval:def:602199
Several vulnerabilities have been fixed in Wordpress, the popular blogging engine. CVE-2015-2213 SQL Injection allowed a remote attacker to compromise the site. CVE-2015-5622 The robustness of the shortcodes HTML tags filter has been improved. The parsing is a bit more strict, which may affect your ...

oval:org.secpod.oval:def:602559
A vulnerability was discovered in mysql-connector-java, a Java database driver for MySQL, which may result in unauthorized update, insert or delete access to some MySQL Connectors accessible data as well as read access to a subset of MySQL Connectors accessible data. The vulnerability was addressed ...

oval:org.secpod.oval:def:1501161
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way NSS verified certain ECDSA signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery ...

oval:org.secpod.oval:def:1501162
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way NSS verified certain ECDSA signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery ...

oval:org.secpod.oval:def:1501118
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. It was found that NSS permitted skipping of the ServerKeyExchange packet during a handshake involving ECDHE . A remote attacker could use this flaw to b ...

oval:org.secpod.oval:def:501644
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way NSS verified certain ECDSA signatures. Under certain conditions, an attacker could use this flaw to conduct signature forge ...

oval:org.secpod.oval:def:501637
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. It was found that NSS permitted skipping of the ServerKeyExchange packet during a handshake involving ECDHE . A remote attacker could use this flaw to b ...

oval:org.secpod.oval:def:1200171
A flaw was found in the way NSS verified certain ECDSA signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery attacks.

oval:org.secpod.oval:def:203697
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. It was found that NSS permitted skipping of the ServerKeyExchange packet during a handshake involving ECDHE . A remote attacker could use this flaw to b ...

oval:org.secpod.oval:def:25633
The host is installed with Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 or 38.x before 38.1 and is prone to an ECDSA signatures spoofing vulnerability. A flaw is present in the applications, which do not properly perform Elliptical Curve Cryptography (ECC) multiplications. Successful ex ...

oval:org.secpod.oval:def:25634
The host is missing a critical security update according to Mozilla advisory, MFSA-2015-64. The update is required to fix an ECDSA signatures spoofing vulnerability. A flaw is present in the applications, which do not properly perform Elliptical Curve Cryptography (ECC) multiplications. Successful e ...

oval:org.secpod.oval:def:602195
Several vulnerabilities have been discovered in nss, the Mozilla Network Security Service library. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-2721 Karthikeyan Bhargavan discovered that NSS incorrectly handles state transitions for the TLS state machi ...

oval:org.secpod.oval:def:203724
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way NSS verified certain ECDSA signatures. Under certain conditions, an attacker could use this flaw to conduct signature forge ...

oval:org.secpod.oval:def:203711
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way NSS verified certain ECDSA signatures. Under certain conditions, an attacker could use this flaw to conduct signature forge ...

oval:org.secpod.oval:def:1501056
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with th ...

oval:org.secpod.oval:def:1501057
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with th ...

oval:org.secpod.oval:def:1501058
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with th ...

oval:org.secpod.oval:def:1501067
Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. It ...

oval:org.secpod.oval:def:1501069
Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. It ...

oval:org.secpod.oval:def:203673
Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. I ...

oval:org.secpod.oval:def:203663
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with th ...

oval:org.secpod.oval:def:203661
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with th ...

oval:org.secpod.oval:def:203660
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with th ...

oval:org.secpod.oval:def:203666
Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. I ...

oval:org.secpod.oval:def:203668
Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. I ...

oval:org.secpod.oval:def:25615
The host is installed with Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8, 38.x before 38.1, Thunderbird before 31.8 or 38.x before 38.1 and is prone to an unspecified vulnerability. A flaw is present in the applications, which read data from uninitialized memory locations. Successful exp ...

oval:org.secpod.oval:def:25616
The host is missing a critical security update according to Mozilla advisory, MFSA-2015-66. The update is required to fix unspecified vulnerabilities. The flaws are present in the applications, which read data from uninitialized memory locations. Successful exploitation could allow attackers to caus ...

oval:org.secpod.oval:def:25619
The host is installed with Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8, 38.x before 38.1, Thunderbird before 31.8 or 38.x before 38.1 and is prone to an unspecified vulnerability. A flaw is present in the applications, which read data from uninitialized memory locations. Successful exp ...

oval:org.secpod.oval:def:25620
The host is installed with Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8, 38.x before 38.1, Thunderbird before 31.8 or 38.x before 38.1 and is prone to an unspecified vulnerability. A flaw is present in the applications, which read data from uninitialized memory locations. Successful exp ...

oval:org.secpod.oval:def:25621
The host is installed with Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8, 38.x before 38.1, Thunderbird before 31.8 or 38.x before 38.1 and is prone to an unspecified vulnerability. A flaw is present in the applications, which access unintended memory locations. Successful exploitation c ...

oval:org.secpod.oval:def:501588
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with th ...

oval:org.secpod.oval:def:501591
Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. I ...

oval:org.secpod.oval:def:25185
The host is installed with kernel on Red Hat Enterprise Linux 6 or 7 and is prone to a privilege escalation vulnerability. A flaw is present in the application, which fails to properly handle fork(2) and close(2) system calls with an 'int80' entry. Successful exploitation could allow attackers to es ...

oval:org.secpod.oval:def:1501073
The kernel packages contain the Linux kernel, the core of any Linux operating system. * A NULL pointer dereference flaw was found in the way the Linux kernel"s virtual console implementation handled reference counting when accessing pseudo-terminal device files . A local, unprivileged attacker could ...

oval:org.secpod.oval:def:1501071
The kernel packages contain the Linux kernel, the core of any Linux operating system. * A NULL pointer dereference flaw was found in the way the Linux kernel"s virtual console implementation handled reference counting when accessing pseudo-terminal device files . A local, unprivileged attacker could ...

oval:org.secpod.oval:def:25164
The host is installed with kernel on Red Hat Enterprise Linux 6 or 7 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to properly handle Router advertisements. Successful exploitation could allow attackers to crash the service.

oval:org.secpod.oval:def:602653
Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service or incorrect certificate validation.

oval:org.secpod.oval:def:109467
Icecast is a streaming media server which currently supports Ogg Vorbis and MP3 audio streams. It can be used to create an Internet radio station or a privately running jukebox and many things in between. It is very versatile in that new formats can be added relatively easily and supports open stand ...

oval:org.secpod.oval:def:109438
Icecast is a streaming media server which currently supports Ogg Vorbis and MP3 audio streams. It can be used to create an Internet radio station or a privately running jukebox and many things in between. It is very versatile in that new formats can be added relatively easily and supports open stand ...

oval:org.secpod.oval:def:602064
Juliane Holzt discovered that Icecast2, a streaming media server, could dereference a NULL pointer when URL authentication is configured and the stream_auth URL is trigged by a client without setting any credentials. This could allow remote attackers to cause a denial of service .

oval:org.secpod.oval:def:1501103
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+passwo ...

oval:org.secpod.oval:def:501616
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker ab ...

oval:org.secpod.oval:def:501688
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker ab ...

oval:org.secpod.oval:def:108772
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+passwo ...

oval:org.secpod.oval:def:602061
It was discovered that cURL, an URL transfer library, if configured to use a proxy server with the HTTPS protocol, by default could send to the proxy the same HTTP headers it sends to the destination server, possibly leaking sensitive information.

oval:org.secpod.oval:def:204257
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker ab ...

oval:org.secpod.oval:def:204236
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker ab ...

oval:org.secpod.oval:def:1501245
The remote host is missing a patch containing a security fix, which affects the following package(s): curl

oval:org.secpod.oval:def:109343
The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote prog ...

oval:org.secpod.oval:def:24344
curl: HTTP, HTTPS, and FTP client and client libraries Several security issues were fixed in curl.

oval:org.secpod.oval:def:108862
The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote prog ...

oval:org.secpod.oval:def:1501055
PostgreSQL is an advanced object-relational database management system . A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is tri ...

oval:org.secpod.oval:def:1501054
PostgreSQL is an advanced object-relational database management system . A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is tri ...

oval:org.secpod.oval:def:1200106
A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. It was discovered that PostgreSQL did not properly check the retu ...

oval:org.secpod.oval:def:1200109
Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service by closing an SSL session at a time when the authentication timeout will expire during the session shutdow ...

oval:org.secpod.oval:def:1200102
Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service by closing an SSL session at a time when the authentication timeout will expire during the session shutdow ...

oval:org.secpod.oval:def:203658
PostgreSQL is an advanced object-relational database management system . A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is tri ...

oval:org.secpod.oval:def:203657
PostgreSQL is an advanced object-relational database management system . A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is tri ...

oval:org.secpod.oval:def:602111
Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. CVE-2015-3165 SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. CVE-2015-3166 The replacement implementation of snprintf failed to check for errors reported by th ...

oval:org.secpod.oval:def:602109
Several vulnerabilities have been found in PostgreSQL-9.1, a SQL database system. CVE-2015-3165 SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. CVE-2015-3166 The replacement implementation of snprintf failed to check for errors reported by th ...

oval:org.secpod.oval:def:602124
The update for postgresql-9.1 in DSA-3269-1 introduced a regression which can causes PostgreSQL to refuse to restart after an unexpected shutdown or when restoring from a binary backup. Updated packages are now available to address this regression. Please refer to the upstream Bug FAQ for additional ...

oval:org.secpod.oval:def:501586
PostgreSQL is an advanced object-relational database management system . A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is tri ...

oval:org.secpod.oval:def:1600359
It was found that when an SVN server searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable . An integer overflow was discovered allowing remote attackers to execute arbitrary code via an svn:// protocol string, whi ...

oval:org.secpod.oval:def:110243
Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Subversion only stores the differences between versions, instead of every complete file. Subvers ...

oval:org.secpod.oval:def:33775
The host is missing a patch containing a security fixes, which affects the following package(s): openssl.base

oval:org.secpod.oval:def:109109
NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems. NTFS-3G can create, remove, re ...

oval:org.secpod.oval:def:109160
With FUSE it is possible to implement a fully functional filesystem in a userspace program. This package contains the FUSE userspace tools to mount a FUSE filesystem.

oval:org.secpod.oval:def:109169
With FUSE it is possible to implement a fully functional filesystem in a userspace program. This package contains the FUSE userspace tools to mount a FUSE filesystem.

oval:org.secpod.oval:def:109191
NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems. NTFS-3G can create, remove, re ...

oval:org.secpod.oval:def:109189
With FUSE it is possible to implement a fully functional filesystem in a userspace program. This package contains the FUSE userspace tools to mount a FUSE filesystem.

oval:org.secpod.oval:def:109152
NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems. NTFS-3G can create, remove, re ...

oval:org.secpod.oval:def:1200035
It was discovered that fusermount failed to properly sanitize its environment before executing mount and umount commands. A local user could possibly use this flaw to escalate their privileges on the system.

oval:org.secpod.oval:def:25179
The host is installed with fuse on Red Hat Enterprise Linux 7 and is prone to a privilege escalation vulnerability. A flaw is present in the application, which fails to properly filter environment variables. Successful exploitation could allow attackers to escalate privileges.

oval:org.secpod.oval:def:602113
Tavis Ormandy discovered that FUSE, a Filesystem in USErspace, does not scrub the environment before executing mount or umount with elevated privileges. A local user can take advantage of this flaw to overwrite arbitrary files and gain elevated privileges by accessing debugging features via the envi ...

oval:org.secpod.oval:def:602112
Tavis Ormandy discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing mount or umount with elevated privileges. A local user can take advantage of this flaw to overwrite arbitrary files and gain elevated privileges by accessing debugging features v ...

oval:org.secpod.oval:def:602108
The patch applied for ntfs-3g to fix CVE-2015-3202 in DSA 3268-1 was incomplete. This update corrects that problem. For reference the original advisory text follows. Tavis Ormandy discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing mount or umo ...

oval:org.secpod.oval:def:602555
Two cross-site scripting vulnerabilities have been found in Horizon, a web application to control an OpenStack cloud.

oval:org.secpod.oval:def:1200038
LOGJAM: A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange . An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient pre-computation. This can lead to a passive man-in-the-middle attack in wh ...

oval:org.secpod.oval:def:1501275
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. A NULL pointer derefernce flaw was found in the way OpenSSL verified signatures using the RSA PSS algorithm. A remote attacked cou ...

oval:org.secpod.oval:def:109469
Rack provides a common API for connecting web frameworks, web servers and layers of software in between

oval:org.secpod.oval:def:109439
Rack provides a common API for connecting web frameworks, web servers and layers of software in between

oval:org.secpod.oval:def:204273
The pcs package provides a configuration tool for Corosync and Pacemaker. It permits users to easily view, modify and create Pacemaker based clusters. The pcs package includes Rack, which provides a minimal interface between webservers that support Ruby and Ruby frameworks. A flaw was found in a way ...

oval:org.secpod.oval:def:602183
Tomek Rabczak from the NCC Group discovered a flaw in the normalize_params method in Rack, a modular Ruby webserver interface. A remote attacker can use this flaw via specially crafted requests to cause a `SystemStackError` and potentially cause a denial of service condition for the service.

oval:org.secpod.oval:def:109651
The Simple Protocol for Independent Computing Environments is a remote display system built for virtual environments which allows you to view a computing "desktop" environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architect ...

oval:org.secpod.oval:def:109645
Header files describing the spice protocol and the para-virtual graphics card QXL.

oval:org.secpod.oval:def:109641
Client libraries for SPICE desktop servers.

oval:org.secpod.oval:def:109633
Header files describing the spice protocol and the para-virtual graphics card QXL.

oval:org.secpod.oval:def:109639
Client libraries for SPICE desktop servers.

oval:org.secpod.oval:def:501689
The cups-filters packages contain back ends, filters, and other software that was once part of the core Common UNIX Printing System distribution but is now maintained independently. A heap-based buffer overflow flaw and an integer overflow flaw leading to a heap-based buffer overflow were discovere ...

oval:org.secpod.oval:def:702629
cups-filters: OpenPrinting CUPS Filters cups-filters could be made to crash or run programs as the lp user if it processed a specially crafted print job.

oval:org.secpod.oval:def:204254
The cups-filters packages contain back ends, filters, and other software that was once part of the core Common UNIX Printing System distribution but is now maintained independently. A heap-based buffer overflow flaw and an integer overflow flaw leading to a heap-based buffer overflow were discovere ...

oval:org.secpod.oval:def:1501233
The remote host is missing a patch containing a security fix, which affects the following package(s): cups-filters

oval:org.secpod.oval:def:109339
Contains backends, filters, and other software that was once part of the core CUPS distribution but is no longer maintained by Apple Inc. In addition it contains additional filters developed independently of Apple, especially filters for the PDF-centric printing workflow introduced by OpenPrinting.

oval:org.secpod.oval:def:109323
Contains backends, filters, and other software that was once part of the core CUPS distribution but is no longer maintained by Apple Inc. In addition it contains additional filters developed independently of Apple, especially filters for the PDF-centric printing workflow introduced by OpenPrinting.

oval:org.secpod.oval:def:602166
It was discovered that the texttopdf utility, part of cups-filters, was susceptible to multiple heap-based buffer overflows due to improper handling of print jobs with a specially crafted line size. This could allow remote attackers to crash texttopdf or possibly execute arbitrary code.

oval:org.secpod.oval:def:703349
linux-lts-trusty: Linux hardware enablement kernel from Trusty for Precise Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:703347
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:1501040
The kernel packages contain the Linux kernel, the core of any Linux operating system. * It was found that the Linux kernel"s implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access o ...

oval:org.secpod.oval:def:702521
oxide-qt: Web browser engine library for Qt Several security issues were fixed in Oxide.

oval:org.secpod.oval:def:26796
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a denial of service vulnerability. A flaw is present in the application, which does not always ask the user before proceeding with CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK changes. Successful exp ...

oval:org.secpod.oval:def:26795
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a denial of service vulnerability. A flaw is present in the application, which does not always ask the user before proceeding with CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK changes. Successful exp ...

oval:org.secpod.oval:def:26799
The host is installed with Google Chrome before 42.0.2311.90 and is prone to an information disclosure vulnerability. A flaw is present in the application, which does not always display "Media: Allowed by you" in a Permissions table after the user has granted camera permission to a web site. Success ...

oval:org.secpod.oval:def:602056
The Google security team and the smart hardware research group of Alibaba security team discovered a flaw in how wpa_supplicant used SSID information when creating or updating P2P peer entries. A remote attacker can use this flaw to cause wpa_supplicant to crash, expose memory contents, and potentia ...

oval:org.secpod.oval:def:26802
The host is installed with Google Chrome before 42.0.2311.90 and is prone to multiple unspecifies vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation could allow attackers to cause a denial of service or possibly have other impact ...

oval:org.secpod.oval:def:26801
The host is installed with Google Chrome before 42.0.2311.90 and is prone to multiple unspecifies vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation could allow attackers to cause a denial of service or possibly have other impact ...

oval:org.secpod.oval:def:26803
The host is installed with Google Chrome before 42.0.2311.90 and is prone to a denial of service vulnerability. A flaw is present in the application, which does not always ask the user before proceeding with CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK changes. Successful exp ...

oval:org.secpod.oval:def:26805
The host is installed with Google Chrome before 42.0.2311.90 and is prone to an information disclosure vulnerability. A flaw is present in the application, which does not always display "Media: Allowed by you" in a Permissions table after the user has granted camera permission to a web site. Success ...

oval:org.secpod.oval:def:26800
The host is installed with Google Chrome before 42.0.2311.90 and is prone to an information disclosure vulnerability. A flaw is present in the application, which does not always display "Media: Allowed by you" in a Permissions table after the user has granted camera permission to a web site. Success ...

oval:org.secpod.oval:def:24273
Several vulnerabilities were discovered in the chromium web browser. CVE-2015-1235 A Same Origin Policy bypass issue was discovered in the HTML parser. CVE-2015-1236 Amitay Dobo discovered a Same Origin Policy bypass in the Web Audio API. CVE-2015-1237 Khalil Zhani discovered a use-after-free issue ...

oval:org.secpod.oval:def:1501102
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:1501108
Moderate: Oracle Linux 5 Unbreakable Enterprise kernel security update.

oval:org.secpod.oval:def:1501111
Moderate: Oracle Linux 6 Unbreakable Enterprise kernel security update.

oval:org.secpod.oval:def:1501115
Moderate: Oracle Linux 6 Unbreakable Enterprise kernel security update.

oval:org.secpod.oval:def:1501116
Moderate: Oracle Linux 5 Unbreakable Enterprise kernel security update.

oval:org.secpod.oval:def:501622
The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way Linux kernel"s Transparent Huge Pages implementation handled non-huge page migration. A local, unprivileged user could use this flaw to crash the kernel by migrating transparent hugep ...

oval:org.secpod.oval:def:602299
Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure.

oval:org.secpod.oval:def:501694
The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel"s file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a conta ...

oval:org.secpod.oval:def:1501096
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:702561
linux-ti-omap4: Linux kernel for OMAP4 Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:702544
linux-ec2: Linux kernel for EC2 The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:702535
linux: Linux kernel The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:702533
linux: Linux kernel The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:702538
linux: Linux kernel The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:702537
linux: Linux kernel The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:702529
linux: Linux kernel The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:702525
linux-lts-utopic: Linux hardware enablement kernel from Utopic The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:1501253
The flaws were found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a container could use this flaw to escape the bind mount and, potentially, escalate their p ...

oval:org.secpod.oval:def:25176
The host is installed with kernel on Red Hat Enterprise Linux 6 or 7 and is prone to a race condition vulnerability. A flaw is present in the application, which fails to properly handle set file permissions in certain conditions. Successful exploitation could allow attackers to execute crafted file ...

oval:org.secpod.oval:def:204242
The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way Linux kernel"s Transparent Huge Pages implementation handled non-huge page migration. A local, unprivileged user could use this flaw to crash the kernel by migrating transparent hugep ...

oval:org.secpod.oval:def:24346
linux-lts-trusty: Linux hardware enablement kernel from Trusty The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:39494
The host is installed with Apple iTunes before 12.6 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to handle a crafted COLLATE clause. Successful exploitation allows attackers to cause a denial of service (uninitialized memory access and applicat ...

oval:org.secpod.oval:def:39495
The host is installed with Apple iTunes before 12.6 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to handle a crafted CHECK clause. Successful exploitation allows attackers to cause a denial of service (invalid free operation) or possibly have u ...

oval:org.secpod.oval:def:39496
The host is installed with Apple iTunes before 12.6 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to handle large integers in a crafted printf function call in a SELECT statement. Successful exploitation allows attackers to cause denial of servi ...

oval:org.secpod.oval:def:1501147
SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database w ...

oval:org.secpod.oval:def:1501119
SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database w ...

oval:org.secpod.oval:def:25770
sqlite3: C library that implements an SQL database engine SQLite could be made to crash or run programs if it processed specially crafted queries.

oval:org.secpod.oval:def:25771
sqlite3: C library that implements an SQL database engine SQLite could be made to crash or run programs if it processed specially crafted queries.

oval:org.secpod.oval:def:501632
SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database w ...

oval:org.secpod.oval:def:501636
SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database w ...

oval:org.secpod.oval:def:602264
Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs.

oval:org.secpod.oval:def:24535
The host is installed with ntp version 4.2.6 and earlier on Redhat Enterprise Linux 6 or on Redhat Enterprise Linux 7 and is prone to an endless loop vulnerability. A flaw is present in the application, which fails to handle MD5 symmetric keys on big-endian systems. Successful exploitation could all ...

oval:org.secpod.oval:def:501737
The Network Time Protocol is used to synchronize a computer"s time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service. It was found that because NTP"s access control was based ...

oval:org.secpod.oval:def:1501086
Multiple vulnerabilities were discovered in ntp, an implementation of the Network Time Protocol: CVE-2015-1798 When configured to use a symmetric key with an NTP peer, ntpd would accept packets without MAC as if they had a valid MAC. This could allow a remote attacker to bypass the packet authentica ...

oval:org.secpod.oval:def:1200118
A flaw was found in the way SQLite handled dequoting of collation-sequence names. A local attacker could submit a specially crafted COLLATE statement that would crash the SQLite process, or have other unspecified impacts. It was found that SQLite"s sqlite3VdbeExec function did not properly implement ...

oval:org.secpod.oval:def:1200183
Upstream reports that several bugs have been fixed as well as several security issues into some bundled libraries . All PHP 5.5 users are encouraged to upgrade to this version. Please see the upstream release notes for full details.

oval:org.secpod.oval:def:1200153
As discussed upstream, a flaw was found in the way ntpd processed certain remote configuration packets. Note that remote configuration is disabled by default in NTP. It was found that the :config command can be used to set the pidfile and driftfile paths without any restrictions. A remote attacker c ...

oval:org.secpod.oval:def:203696
SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database w ...

oval:org.secpod.oval:def:203695
SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database w ...

oval:org.secpod.oval:def:501841
The Network Time Protocol is used to synchronize a computer"s time with another referenced time source. It was found that because NTP"s access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by spoofing : ...

oval:org.secpod.oval:def:702685
sqlite3: C library that implements an SQL database engine SQLite could be made to crash or run programs if it processed specially crafted queries.

oval:org.secpod.oval:def:1200078
Upstream reports that several bugs have been fixed as well as several security issues into some bundled libraries . All PHP 5.6 users are encouraged to upgrade to this version. Please see the upstream release notes for full details.

oval:org.secpod.oval:def:108773
The Network Time Protocol is used to synchronize a computer"s time with another reference time source. This package includes ntpd and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl package, ntpdate is in the ntpdate package and sntp is ...

oval:org.secpod.oval:def:602093
Michal Zalewski discovered multiple vulnerabilities in SQLite, which may result in denial of service or the execution of arbitrary code.

oval:org.secpod.oval:def:1200021
Upstream reports that six security-related issues in PHP were fixed in this release, as well as several security issues in bundled sqlite library . All PHP 5.4 users are encouraged to upgrade to this version. Please see the upstream release notes for full details.

oval:org.secpod.oval:def:204271
The Network Time Protocol is used to synchronize a computer"s time with another referenced time source. It was found that because NTP"s access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by spoofing : ...

oval:org.secpod.oval:def:204260
The Network Time Protocol is used to synchronize a computer"s time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service. It was found that because NTP"s access control was based ...

oval:org.secpod.oval:def:1501243
The remote host is missing a patch containing a security fix, which affects the following package(s): ntp

oval:org.secpod.oval:def:602142
Michal Zalewski discovered that SQLite3, an implementation of an SQL database engine, did not properly handle precision and width values during floating-point conversions, leading to an integer overflow and a stack-based buffer overflow. This could allow remote attackers to cause a denial of service ...

oval:org.secpod.oval:def:602087
It was discovered that the fix for CVE-2013-4422 in quassel, a distributed IRC client, was incomplete. This could allow remote attackers to inject SQL queries after a database reconnection .

oval:org.secpod.oval:def:602141
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4

oval:org.secpod.oval:def:602189
Several vulnerabilities have been found in Wordpress, the popular blogging engine. CVE-2015-3429 The file example.html in the Genericicons icon font package and twentyfifteen Wordpress theme allowed for cross site scripting. CVE-2015-5622 The robustness of the shortcodes HTML tags filter has been im ...

oval:org.secpod.oval:def:602186
The security update for wordpress in DSA 3328 contained a regression. The patch for issue CVE-2015-5622 was faulty. A new package version has been released that backs this patch out pending resolution of the problem.

oval:org.secpod.oval:def:110476
eCAP is a software interface that allows a network application, such as an HTTP proxy or an ICAP server, to outsource content analysis and adaptation to a loadable module. For each applicable protocol message being processed, an eCAP-enabled host application supplies the message details to the adapt ...

oval:org.secpod.oval:def:110470
Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DNS l ...

oval:org.secpod.oval:def:109402
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:25795
qemu: Machine emulator and virtualizer - qemu-kvm: Machine emulator and virtualizer Several security issues were fixed in QEMU.

oval:org.secpod.oval:def:702557
qemu: Machine emulator and virtualizer - qemu-kvm: Machine emulator and virtualizer Several security issues were fixed in QEMU.

oval:org.secpod.oval:def:109186
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:109208
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system , including a processor and various peripherials. It can be used to launch differe ...

oval:org.secpod.oval:def:109225
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:109222
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:602088
Several vulnerabilities were discovered in the qemu virtualisation solution: CVE-2014-9718 It was discovered that the IDE controller emulation is susceptible to denial of service. CVE-2015-1779 Daniel P. Berrange discovered a denial of service vulnerability in the VNC web socket decoder. CVE-2015-27 ...

oval:org.secpod.oval:def:109311
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:108883
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:108879
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:108863
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system , including a processor and various peripherials. It can be used to launch differe ...

oval:org.secpod.oval:def:1501145
Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.

oval:org.secpod.oval:def:109462
The kernel meta package

oval:org.secpod.oval:def:109409
The kernel meta package

oval:org.secpod.oval:def:501627
The kernel packages contain the Linux kernel, the core of any Linux operating system. * An integer overflow flaw was found in the way the Linux kernel"s netfilter connection tracking implementation loaded extensions. An attacker on a local network could potentially send a sequence of specially craft ...

oval:org.secpod.oval:def:1501070
The kernel packages contain the Linux kernel, the core of any Linux operating system. * A NULL pointer dereference flaw was found in the way the Linux kernel"s virtual console implementation handled reference counting when accessing pseudo-terminal device files . A local, unprivileged attacker could ...

oval:org.secpod.oval:def:1501072
The kernel packages contain the Linux kernel, the core of any Linux operating system. * A NULL pointer dereference flaw was found in the way the Linux kernel"s virtual console implementation handled reference counting when accessing pseudo-terminal device files . A local, unprivileged attacker could ...

oval:org.secpod.oval:def:1501075
The kernel packages contain the Linux kernel, the core of any Linux operating system. * A NULL pointer dereference flaw was found in the way the Linux kernel"s virtual console implementation handled reference counting when accessing pseudo-terminal device files . A local, unprivileged attacker could ...

oval:org.secpod.oval:def:109128
The kernel meta package

oval:org.secpod.oval:def:109211
The kernel meta package

oval:org.secpod.oval:def:203683
The kernel packages contain the Linux kernel, the core of any Linux operating system. * An integer overflow flaw was found in the way the Linux kernel"s netfilter connection tracking implementation loaded extensions. An attacker on a local network could potentially send a sequence of specially craft ...

oval:org.secpod.oval:def:203674
The kernel packages contain the Linux kernel, the core of any Linux operating system. * A NULL pointer dereference flaw was found in the way the Linux kernel"s virtual console implementation handled reference counting when accessing pseudo-terminal device files . A local, unprivileged attacker could ...

oval:org.secpod.oval:def:109262
The kernel meta package

oval:org.secpod.oval:def:108880
The kernel package contains the Linux kernel , the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc.

oval:org.secpod.oval:def:108851
The kernel meta package

oval:org.secpod.oval:def:501595
The kernel packages contain the Linux kernel, the core of any Linux operating system. * A NULL pointer dereference flaw was found in the way the Linux kernel"s virtual console implementation handled reference counting when accessing pseudo-terminal device files . A local, unprivileged attacker could ...

oval:org.secpod.oval:def:39507
The host is missing a critical security update according to Apple advisory, APPLE-SA-2017-03-22-1. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to properly handle crafted vectors. Successful exploitation allows attackers to execute arb ...

oval:org.secpod.oval:def:39508
The host is missing a security update according to Apple advisory, APPLE-SA-2017-03-22-2. The update is required to fix multiple vulnerabilities in Apple iTunes. The flaws are present in SQLite and expat which fails to handle vectors related to iTunes, crafted xml files. Successful exploitation coul ...

oval:org.secpod.oval:def:24935
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted vectors. Successful exploitation could allow attackers to bypass security, execute arbitrary code or cra ...

oval:org.secpod.oval:def:24936
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted vectors. Successful exploitation could allow attackers to bypass security, execute arbitrary code or cra ...

oval:org.secpod.oval:def:1501022
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use thi ...

oval:org.secpod.oval:def:1501023
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use thi ...

oval:org.secpod.oval:def:1501047
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use this flaw to force the us ...

oval:org.secpod.oval:def:25890
The host is missing a patch containing security fixes, which affects the following package(s): bos.net.tcp.client

oval:org.secpod.oval:def:109112
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security stan ...

oval:org.secpod.oval:def:109101
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security stan ...

oval:org.secpod.oval:def:1501051
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use this flaw to force the us ...

oval:org.secpod.oval:def:25420
The host is missing a patch containing a security fixes, which affects the following package(s): openssl.base

oval:org.secpod.oval:def:109164
Network Security Services Softoken Cryptographic Module

oval:org.secpod.oval:def:109190
Utilities for Network Security Services and the Softoken module

oval:org.secpod.oval:def:109187
Network Security Services Softoken Cryptographic Module

oval:org.secpod.oval:def:109120
Utilities for Network Security Services and the Softoken module

oval:org.secpod.oval:def:109143
Utilities for Network Security Services and the Softoken module

oval:org.secpod.oval:def:109144
Network Security Services Softoken Cryptographic Module

oval:org.secpod.oval:def:203649
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use this flaw to force the us ...

oval:org.secpod.oval:def:203638
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use thi ...

oval:org.secpod.oval:def:109202
The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.

oval:org.secpod.oval:def:203639
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use thi ...

oval:org.secpod.oval:def:109227
The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.

oval:org.secpod.oval:def:203662
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An out-of-bounds read flaw was found in the X509_cmp_time function of OpenSSL. A specially crafted X.509 certificate or a Certific ...

oval:org.secpod.oval:def:203652
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use this flaw to force the us ...

oval:org.secpod.oval:def:203650
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use this flaw to force the us ...

oval:org.secpod.oval:def:203656
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use this flaw to force the us ...

oval:org.secpod.oval:def:702642
firefox: Mozilla Open Source web browser Firefox could be made to crash or run programs as your login if it opened a malicious website.

oval:org.secpod.oval:def:702649
thunderbird: Mozilla Open Source mail and newsgroup client Several security issues were fixed in Thunderbird.

oval:org.secpod.oval:def:1200046
A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use this flaw to force the use of weak 512 bit export-grade keys during the key exchange, allowing them do decrypt all traffic. Please note that this update forces the TLS/SSL c ...

oval:org.secpod.oval:def:109274
The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.

oval:org.secpod.oval:def:109268
The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.

oval:org.secpod.oval:def:25642
The host is installed with OpenSSL 1.0.1 before 1.0.1n or 1.0.2 before 1.0.2b, Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8, 38.x before 38.1, Thunderbird before 31.8 or 38.x before 38.1 and is prone to a logjam attack vulnerability. A flaw is present in the applications, which fail to ...

oval:org.secpod.oval:def:25643
The host is missing a critical security update according to Mozilla advisory, MFSA-2015-70. The update is required to fix a logjam attack vulnerability. A flaw is present in the applications, which fail to handle a weak key. Successful exploitation could allow man-in-the-middle (MITM) attackers to f ...

oval:org.secpod.oval:def:602137
Multiple vulnerabilities were discovered in OpenSSL, a Secure Sockets Layer toolkit. CVE-2014-8176 Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that an invalid memory free could be triggered when buffering DTLS data. This could allow remote attackers to cause a denial of service ...

oval:org.secpod.oval:def:602160
Multiple security issues have been found in Iceweasel, Debian"s version of the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code or denial of service. This update also addresses a vulnerability in D ...

oval:org.secpod.oval:def:602185
Multiple security issues have been found in Icedove, Debian"s version of the Mozilla Thunderbird mail client: multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code or denial of service. This update also addresses a vulnerability in ...

oval:org.secpod.oval:def:25609
The host is installed with Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8, 38.x before 38.1, Thunderbird before 31.8 or 38.x before 38.1 and is prone to a logjam attack vulnerability. A flaw is present in the applications, which fail to handle a weak key. Successful exploitation could all ...

oval:org.secpod.oval:def:25610
The host is missing a critical security update according to Mozilla advisory, MFSA-2015-70. The update is required to fix a logjam attack vulnerability. A flaw is present in the applications, which fail to handle a weak key. Successful exploitation could allow man-in-the-middle (MITM) attackers to f ...

oval:org.secpod.oval:def:501573
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use thi ...

oval:org.secpod.oval:def:501585
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An out-of-bounds read flaw was found in the X509_cmp_time function of OpenSSL. A specially crafted X.509 certificate or a Certific ...

oval:org.secpod.oval:def:501584
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way the TLS protocol composes the Diffie-Hellman key exchange. A man-in-the-middle attacker could use this flaw to force the us ...

oval:org.secpod.oval:def:203642
The wpa_supplicant package contains an 802.1X Supplicant with support for WEP, WPA, WPA2 , and various EAP authentication methods. It implements key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver. A ...

oval:org.secpod.oval:def:501578
The wpa_supplicant package contains an 802.1X Supplicant with support for WEP, WPA, WPA2 , and various EAP authentication methods. It implements key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver. A ...

oval:org.secpod.oval:def:602270
Multiple vulnerabilities have been discovered in LibreOffice, a full-featured office productivity: CVE-2015-4551 Federico Scrinzi discovered an information leak in the handling of ODF documents. Quoting from https://www.libreoffice.org/about-us/security/advisories/cve-2015-4551/: The LinkUpdateMode ...

oval:org.secpod.oval:def:31652
The host is installed with LibreOffice before 4.4.5 or Apache OpenOffice before 4.1.2 and is prone to an information disclosure vulnerability. A flaw is present in the applications, which use the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling ...

oval:org.secpod.oval:def:702823
libreoffice: Office productivity suite Several security issues were fixed in LibreOffice.

oval:org.secpod.oval:def:1501266
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extend ...

oval:org.secpod.oval:def:1501278
It was discovered that LibreOffice did not properly restrict automatic link updates. By tricking a victim into opening specially crafted documents, an attacker could possibly use this flaw to disclose contents of files accessible by the victim.

oval:org.secpod.oval:def:203784
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extend ...

oval:org.secpod.oval:def:203785
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extend ...

oval:org.secpod.oval:def:25422
The host is installed with Wireshark 1.12.x before 1.12.6 and is prone to denial of service vulnerability. A flaw is present in the application, which fails to properly validate digit characters. Successful exploitation allows remote attackers to cause a denial of service.

oval:org.secpod.oval:def:25423
The host is installed with Wireshark 1.12.x before 1.12.6 and is prone to denial of service vulnerability. A flaw is present in the application, which fails to properly determine whether enough memory is available for storing IP address strings. Successful exploitation allows remote attackers to cau ...

oval:org.secpod.oval:def:25424
The host is installed with Wireshark 1.12.x before 1.12.6 and is prone to denial of service vulnerability. A flaw is present in the application, which fails to properly validate digit characters. Successful exploitation allows remote attackers to cause a denial of service.

oval:org.secpod.oval:def:25425
The host is installed with Wireshark 1.12.x before 1.12.6 and is prone to denial of service vulnerability. A flaw is present in the application, which fails to properly determine whether enough memory is available for storing IP address strings. Successful exploitation allows remote attackers to cau ...

oval:org.secpod.oval:def:602153
Multiple vulnerabilities were discovered in the dissectors for WCCP and GSM DTAP, which could result in denial of service. The oldstable distribution is not affected.

oval:org.secpod.oval:def:602171
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.44

oval:org.secpod.oval:def:1501135
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory p ...

oval:org.secpod.oval:def:1501139
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. It was found that the MySQL client library permitted but did not require a client to use SSL/TLS when establishing a secure connection to a MySQL server using the "--ssl" option. A man-in-the- ...

oval:org.secpod.oval:def:1501109
Important: Oracle Linux 7 java-1.6.0-openjdk security update.

oval:org.secpod.oval:def:1501110
Important: Oracle Linux 6 java-1.6.0-openjdk security update.

oval:org.secpod.oval:def:1501114
Important: Oracle Linux 5 java-1.6.0-openjdk security update.

oval:org.secpod.oval:def:501640
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. It was found that the MySQL client library permitted but did not require a client to use SSL/TLS when establishing a secure connection to a MySQL server using the "--ssl" option. A man-in-the- ...

oval:org.secpod.oval:def:602207
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure, denial of service or insecure cryptography.

oval:org.secpod.oval:def:501624
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java ...

oval:org.secpod.oval:def:501630
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory p ...

oval:org.secpod.oval:def:1501062
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certa ...

oval:org.secpod.oval:def:1501066
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java ...

oval:org.secpod.oval:def:1501064
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java ...

oval:org.secpod.oval:def:1501068
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certa ...

oval:org.secpod.oval:def:1501074
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certa ...

oval:org.secpod.oval:def:702745
icu: International Components for Unicode library Several security issues were fixed in ICU.

oval:org.secpod.oval:def:1200126
Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol ...

oval:org.secpod.oval:def:702704
openjdk-6: Open Source Java implementation Several security issues were fixed in OpenJDK 6.

oval:org.secpod.oval:def:1200167
Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol ...

oval:org.secpod.oval:def:204187
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java ...

oval:org.secpod.oval:def:203691
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory p ...

oval:org.secpod.oval:def:203693
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. It was found that the MySQL client library permitted but did not require a client to use SSL/TLS when establishing a secure connection to a MySQL server using the "--ssl" option. A man-in-the- ...

oval:org.secpod.oval:def:1200104
Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol ...

oval:org.secpod.oval:def:203681
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java ...

oval:org.secpod.oval:def:203682
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java ...

oval:org.secpod.oval:def:203670
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java ...

oval:org.secpod.oval:def:203672
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java ...

oval:org.secpod.oval:def:203671
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java ...

oval:org.secpod.oval:def:203667
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java ...

oval:org.secpod.oval:def:203669
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certa ...

oval:org.secpod.oval:def:702663
openjdk-7: Open Source Java implementation Several security issues were fixed in OpenJDK 7.

oval:org.secpod.oval:def:602173
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure, denial of service or insecure cryptography.

oval:org.secpod.oval:def:501592
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java ...

oval:org.secpod.oval:def:501594
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java ...

oval:org.secpod.oval:def:501593
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certa ...

oval:org.secpod.oval:def:702651
mysql-5.6: MySQL database development files - mysql-5.5: MySQL database Several security issues were fixed in MySQL.

oval:org.secpod.oval:def:203888
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: MariaDB . Refer to the MariaDB Release Notes listed in the References section for a complete list of changes. Security Fix: * It wa ...

oval:org.secpod.oval:def:1501424
MariaDB is a community developed branch of MySQL. MariaDB is a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and ...

oval:org.secpod.oval:def:501798
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: MariaDB . Refer to the MariaDB Release Notes listed in the References section for a complete list of changes. Security Fix: * It wa ...

oval:org.secpod.oval:def:1600337
wolfSSL before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, also know ...

oval:org.secpod.oval:def:110198
MariaDB is a community developed branch of MySQL. MariaDB is a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs an ...

oval:org.secpod.oval:def:110278
MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

oval:org.secpod.oval:def:110258
MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

oval:org.secpod.oval:def:110256
MariaDB is a community developed branch of MySQL. MariaDB is a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs an ...

oval:org.secpod.oval:def:109367
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle.

oval:org.secpod.oval:def:702646
python-django: High-level Python web development framework Several security issues were fixed in Django.

oval:org.secpod.oval:def:602163
Several vulnerabilities were discovered in Django, a high-level Python web development framework: CVE-2015-5143 Eric Peterson and Lin Hua Cheng discovered that a new empty record used to be created in the session storage every time a session was accessed and an unknown session key was provided in th ...

oval:org.secpod.oval:def:602221
Qinghao Tang of QIHU 360 discovered a double free flaw in OpenSLP, an implementation of the IETF Service Location Protocol. This could allow remote attackers to cause a denial of service .

oval:org.secpod.oval:def:702736
openslp-dfsg: OpenSLP development files OpenSLP could be made to crash if it received specially crafted network traffic.

oval:org.secpod.oval:def:33125
The host is installed with Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65 or 8.x before 8.0.27 and is prone to a directory traversal vulnerability. A flaw is present in RequestUtil.java, which fails to handle a /.. (slash dot dot) in a pathname used by a web application in a getResource, getReso ...

oval:org.secpod.oval:def:26471
openslp-dfsg: OpenSLP development files OpenSLP could be made to crash if it received specially crafted network traffic.

oval:org.secpod.oval:def:31653
The host is installed with LibreOffice before 4.4.5 or Apache OpenOffice before 4.1.2 and is prone to an integer underflow vulnerability. A flaw is present in the applications, which fail to handle a crafted PrinterSetup data in an ODF document. Successful exploitation could allow attackers to cause ...

oval:org.secpod.oval:def:31654
The host is installed with LibreOffice before 4.4.5 or Apache OpenOffice before 4.1.2 and is prone to an integer overflow vulnerability. A flaw is present in the applications, which fail to handle a long DOC file, which triggers a buffer overflow. Successful exploitation could allow attackers to cau ...

oval:org.secpod.oval:def:31655
The host is installed with LibreOffice before 4.4.6, 5.x before 5.0.1 or Apache OpenOffice before 4.1.2 and is prone to a memory corruption vulnerability. A flaw is present in the applications, which fail to handle an index to a non-existent bookmark in a DOC file. Successful exploitation could allo ...

oval:org.secpod.oval:def:109587
The Network Time Protocol is used to synchronize a computer"s time with another reference time source. This package includes ntpd and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl package, ntpdate is in the ntpdate package and sntp is ...

oval:org.secpod.oval:def:203841
The glibc packages provide the standard C libraries , POSIX thread libraries , standard math libraries , and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. A stack-based buffer overflow was found in the way ...

oval:org.secpod.oval:def:501768
The glibc packages provide the standard C libraries , POSIX thread libraries , standard math libraries , and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. A stack-based buffer overflow was found in the way ...

oval:org.secpod.oval:def:1501348
The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. A stack-based buffer overflow was found in the way th ...

oval:org.secpod.oval:def:501662
The Simple Protocol for Independent Computing Environments is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtu ...

oval:org.secpod.oval:def:501663
The Simple Protocol for Independent Computing Environments is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtu ...

oval:org.secpod.oval:def:602245
Frediano Ziglio of Red Hat discovered several vulnerabilities in spice, a SPICE protocol client and server library. A malicious guest can exploit these flaws to cause a denial of service , execute arbitrary code on the host with the privileges of the hosting QEMU process or read and write arbitrary ...

oval:org.secpod.oval:def:1501184
The Simple Protocol for Independent Computing Environments is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtu ...

oval:org.secpod.oval:def:1501185
The Simple Protocol for Independent Computing Environments is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtu ...

oval:org.secpod.oval:def:203742
The Simple Protocol for Independent Computing Environments is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtu ...

oval:org.secpod.oval:def:203741
The Simple Protocol for Independent Computing Environments is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtu ...

oval:org.secpod.oval:def:702784
spice: SPICE protocol client and server library Spice could be made to crash or run programs.

oval:org.secpod.oval:def:501669
The Network Time Protocol is used to synchronize a computer"s time with a referenced time source. It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that ...

oval:org.secpod.oval:def:1501194
The Network Time Protocol is used to synchronize a computer"s time with a referenced time source. It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that ...

oval:org.secpod.oval:def:109667
The Network Time Protocol is used to synchronize a computer"s time with another reference time source. This package includes ntpd and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl package, ntpdate is in the ntpdate package and sntp is ...

oval:org.secpod.oval:def:1501200
The Network Time Protocol is used to synchronize a computer"s time with a referenced time source. It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that ...

oval:org.secpod.oval:def:1200052
It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that would increase the client"s polling interval value, and effectively disable synchronization with th ...

oval:org.secpod.oval:def:702814
ntp: Network Time Protocol daemon and utility programs Several security issues were fixed in NTP.

oval:org.secpod.oval:def:203746
The Network Time Protocol is used to synchronize a computer"s time with a referenced time source. It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that ...

oval:org.secpod.oval:def:203745
The Network Time Protocol is used to synchronize a computer"s time with a referenced time source. It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that ...

oval:org.secpod.oval:def:602307
Ivan Zhakov discovered an integer overflow in mod_dav_svn, which allows an attacker with write access to the server to execute arbitrary code or cause a denial of service. The oldstable distribution is not affected.

oval:org.secpod.oval:def:1501600
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application dep ...

oval:org.secpod.oval:def:109969
Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Subversion only stores the differences between versions, instead of every complete file. Subvers ...

oval:org.secpod.oval:def:1600343
A directory traversal vulnerability in RequestUtil.java was discovered which allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths cal ...

oval:org.secpod.oval:def:1600351
A directory traversal vulnerability in RequestUtil.java was discovered which allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths cal ...

oval:org.secpod.oval:def:33123
The host is installed with Apache Tomcat 7.x before 7.0.66 or 8.x before 8.0.30 and is prone to a session fixation vulnerability. A flaw is present in the session-persistence implementation, which fails to handle different session settings used for deployments of multiple versions of the same web ap ...

oval:org.secpod.oval:def:33124
The host is installed with Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.67 or 8.x before 8.0.30 and is prone to an information disclosure vulnerability. A flaw is present in the Mapper component, which processes redirects before considering security constraints and Filters. Successful exploitatio ...

oval:org.secpod.oval:def:33122
The host is installed with Apache Tomcat 7.x before 7.0.68 or 8.x before 8.0.31 and is prone to a security bypass vulnerability. A flaw is present in the Manager and Host Manager applications, which establish sessions and send CSRF tokens for arbitrary new requests. Successful exploitation allows re ...

oval:org.secpod.oval:def:602187
Alex Rousskov of The Measurement Factory discovered that Squid3, a fully featured web proxy cache, does not correctly handle CONNECT method peer responses when configured with cache_peer and operating on explicit proxy traffic. This could allow remote clients to gain unrestricted access through a ga ...

oval:org.secpod.oval:def:702678
tidy: HTML syntax checker and reformatter HTML Tidy could be made to crash or run programs if it processed specially crafted data.

oval:org.secpod.oval:def:602170
Fernando Muñoz discovered that invalid HTML input passed to tidy, an HTML syntax checker and reformatter, could trigger a buffer overflow. This could allow remote attackers to cause a denial of service or potentially execute arbitrary code. Geoff McLane also discovered that a similar iss ...

oval:org.secpod.oval:def:702701
oxide-qt: Web browser engine library for Qt Several security issues were fixed in Oxide.

oval:org.secpod.oval:def:25572
The host is missing a security update according to google advisory. The update is required to fix multiple vulnerabilities in Google Chrome. The flaws are present in the application, which fails to handle crafted data. Successful exploitation could allow remote attackers to execute arbitrary code or ...

oval:org.secpod.oval:def:25573
The host is missing a security update according to google advisory. The update is required to fix multiple vulnerabilities in Google Chrome. The flaws are present in the application, which fails to handle crafted data. Successful exploitation could allow remote attackers to execute arbitrary code or ...

oval:org.secpod.oval:def:602258
The patch applied for CVE-2015-5622 in DSA-3332-1 contained a faulty hunk. This update corrects that problem. For reference, the relevant part of the original advisory text follows. Several vulnerabilities have been fixed in Wordpress, the popular blogging engine. CVE-2015-5622 The robustness of the ...

oval:org.secpod.oval:def:110883
Object relational mapper for PHP that sits on top of a powerful database abstraction layer . One of its' key features is the option to write database queries in a proprietary object oriented SQL dialect called Doctrine Query Language , inspired by Hibernate's HQL. This provides developers w ...

oval:org.secpod.oval:def:602243
Multiple vulnerabilities were discovered in Zend Framework, a PHP framework: CVE-2015-5723 It was discovered that due to incorrect permissions masks when creating directories, local attackers could potentially execute arbitrary code or escalate privileges. ZF2015-08 Chris Kings-Lynne discovered an ...

oval:org.secpod.oval:def:110891
Object relational mapper for PHP that sits on top of a powerful database abstraction layer . One of its' key features is the option to write database queries in a proprietary object oriented SQL dialect called Doctrine Query Language , inspired by Hibernate's HQL. This provides developers w ...

oval:org.secpod.oval:def:109513
Doctrine DBAL & ORM Bundle for the Symfony Framework. Optional: * Doctrine ORM * Symfony Web Profile Bundle * Twig

oval:org.secpod.oval:def:109516
Doctrine DBAL & ORM Bundle for the Symfony Framework. Optional: * Doctrine ORM * Symfony Web Profile Bundle * Twig

oval:org.secpod.oval:def:109518
Cache component extracted from the Doctrine Common project. Optional: * APC * Couchbase * Memcache * Memcached * MongoDB * Redis * Riak * XCache

oval:org.secpod.oval:def:109505
PHP docblock annotations parser library .

oval:org.secpod.oval:def:109507
PHP docblock annotations parser library .

oval:org.secpod.oval:def:109509
Cache component extracted from the Doctrine Common project. Optional: * APC * Couchbase * Memcache * Memcached * MongoDB * Redis * Riak * XCache

oval:org.secpod.oval:def:109934
Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorously tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and co ...

oval:org.secpod.oval:def:109687
Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorously tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and co ...

oval:org.secpod.oval:def:109653
Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorously tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and co ...

oval:org.secpod.oval:def:109939
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle.

oval:org.secpod.oval:def:602233
Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. CVE-2015-5278 Qinghao Tang of QIHU 360 Inc. discovered an infinite loop issue in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service . CVE-2015-5279 Qin ...

oval:org.secpod.oval:def:602231
Several vulnerabilities were discovered in qemu, a fast processor emulator. CVE-2015-5278 Qinghao Tang of QIHU 360 Inc. discovered an infinite loop issue in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service . CVE-2015-5279 Qinghao Tang of QIHU 360 Inc ...

oval:org.secpod.oval:def:109592
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:109588
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system , including a processor and various peripherials. It can be used to launch differe ...

oval:org.secpod.oval:def:109585
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system , including a processor and various peripherials. It can be used to launch differe ...

oval:org.secpod.oval:def:26888
qemu: Machine emulator and virtualizer - qemu-kvm: Machine emulator and virtualizer Several security issues were fixed in QEMU.

oval:org.secpod.oval:def:109620
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:702753
qemu: Machine emulator and virtualizer - qemu-kvm: Machine emulator and virtualizer Several security issues were fixed in QEMU.

oval:org.secpod.oval:def:400696
This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service via crafted BER data, as demonstrated by an attack against slapd. - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. It also fixes the follow ...

oval:org.secpod.oval:def:602639
Several vulnerabilities were discovered in NSS, the cryptography library developed by the Mozilla project. CVE-2015-4000 David Adrian et al. reported that it may be feasible to attack Diffie-Hellman-based cipher suites in certain circumstances, compromising the confidentiality and integrity of data ...

oval:org.secpod.oval:def:702930
libxml2: GNOME XML library libxml2 could be made to crash if it opened a specially crafted file.

oval:org.secpod.oval:def:702967
libgcrypt20: LGPL Crypto library - libgcrypt11: LGPL Crypto library Libgcrypt could be made to expose sensitive information.

oval:org.secpod.oval:def:602374
Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt11 library could be leaked via a side-channel attack. See https://www.cs.tau.ac.IL/~tromer/ecdh/ for details.

oval:org.secpod.oval:def:602369
Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt20 library could be leaked via a side-channel attack. See https://www.cs.tau.ac.IL/~tromer/ecdh/ for details.

oval:org.secpod.oval:def:111001
Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version.

oval:org.secpod.oval:def:111174
Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version.

oval:org.secpod.oval:def:702965
glibc: GNU C Library - eglibc: GNU C Library GNU C Library could be made to crash or run programs if it received specially crafted network traffic.

oval:org.secpod.oval:def:203845
The glibc packages provide the standard C libraries , POSIX thread libraries , standard math libraries , and the Name Server Caching Daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. A stack-based buffer overflow was found in the wa ...

oval:org.secpod.oval:def:501766
The glibc packages provide the standard C libraries , POSIX thread libraries , standard math libraries , and the Name Server Caching Daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. A stack-based buffer overflow was found in the wa ...

oval:org.secpod.oval:def:602376
Several vulnerabilities have been fixed in the GNU C Library, glibc. The first vulnerability listed below is considered to have critical impact. CVE-2015-7547 The Google Security Team and Red Hat discovered that the glibc host name resolver function, getaddrinfo, when processing AF_UNSPEC queries , ...

oval:org.secpod.oval:def:400783
This update for glibc fixes the following security issues: - CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment var ...

oval:org.secpod.oval:def:1600387
A stack-based buffer overflow flaw was found in the send_dg and send_vc functions, used by getaddrinfo and other higher-level interfaces of glibc. A remote attacker able to cause an application to call either of these functions could use this flaw to execute arbitrary code with the permissions of th ...

oval:org.secpod.oval:def:110170
The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important sets ...

oval:org.secpod.oval:def:1501349
The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. A stack-based buffer overflow was found in the way th ...

oval:org.secpod.oval:def:400632
This update for glibc fixes the following security issues: - CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment var ...

oval:org.secpod.oval:def:602260
Two vulnerabilities have been found in unzip, a de-archiver for .zip files. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-7696 Gustavo Grieco discovered that unzip incorrectly handled certain password protected archives. If a user or automated system we ...

oval:org.secpod.oval:def:702833
unzip: De-archiver for .zip files Details: USN-2788-1 fixed vulnerabilities in unzip. One of the security patches caused a regression when extracting 0-byte files. This update fixes the problem. We apologize for the inconvenience. Original advisory USN-2788-1 introduced a regression in unzip.

oval:org.secpod.oval:def:702816
unzip: De-archiver for .zip files unzip could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:602261
John Stumpo discovered that OpenAFS, a distributed file system, does not fully initialize certain network packets before transmitting them. This can lead to a disclosure of the plaintext of previously processed packets.

oval:org.secpod.oval:def:602465
Hans Jerry Illikainen discovered that missing input sanitising in the BMP processing code of the optipng PNG optimiser may result in denial of service or the execution of arbitrary code if a malformed file is processed.

oval:org.secpod.oval:def:31644
libxml2: GNOME XML library Several security issues were fixed in libxml2.

oval:org.secpod.oval:def:501838
The Network Time Protocol is used to synchronize a computer"s time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service. Security Fix: * It was found that the fix for CVE-2014-9 ...

oval:org.secpod.oval:def:204118
The Network Time Protocol is used to synchronize a computer"s time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service. Security Fix: * It was found that the fix for CVE-2014-9 ...

oval:org.secpod.oval:def:31643
libxml2: GNOME XML library Several security issues were fixed in libxml2.

oval:org.secpod.oval:def:110155
MinGW Windows libxml2 XML processing library.

oval:org.secpod.oval:def:110154
MinGW Windows libxml2 XML processing library.

oval:org.secpod.oval:def:400675
- Previous versions of cyrus-imapd would not allow its users to disable old protocols like SSLv1 and SSLv2 that are unsafe due to various known attacks like BEAST and POODLE. https://bugzilla.cyrusimap.org/show_bug.cgi?id=3867 remedies this issue by adding the configuration option "tls_versions" to ...

oval:org.secpod.oval:def:1501303
The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel allows local users to cause a denial of service (OOPS) via crafted keyctl commands.

oval:org.secpod.oval:def:1501307
Race condition in the IPC object implementation in the Linux kernel allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c.

oval:org.secpod.oval:def:1501293
The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel allows local users to cause a denial of service (OOPS) via crafted keyctl commands.

oval:org.secpod.oval:def:1501298
Race condition in the IPC object implementation in the Linux kernel allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c.

oval:org.secpod.oval:def:602278
Several vulnerabilities have been discovered in the libpng PNG library. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-7981 Qixue Xiao discovered an out-of-bounds read vulnerability in the png_convert_to_rfc1123 function. A remote attacker can potentiall ...

oval:org.secpod.oval:def:31645
libpng: PNG file library libpng could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:109914
The libpng10 package contains an old version of libpng, a library of functions for creating and manipulating PNG image format files. This package is needed if you want to run binaries that were linked dynamically with libpng 1.0.x.

oval:org.secpod.oval:def:1501465
The Network Time Protocol is used to synchronize a computer"s time with a referenced time source. It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that w ...

oval:org.secpod.oval:def:702850
libpng: PNG file library libpng could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:1501269
The libpng packages contain a library of functions for creating and manipulating PNG image format files. It was discovered that the png_get_PLTE and png_set_PLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to ...

oval:org.secpod.oval:def:1501271
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

oval:org.secpod.oval:def:109773
The libpng10 package contains an old version of libpng, a library of functions for creating and manipulating PNG image format files. This package is needed if you want to run binaries that were linked dynamically with libpng 1.0.x.

oval:org.secpod.oval:def:109782
The libpng10 package contains an old version of libpng, a library of functions for creating and manipulating PNG image format files. This package is needed if you want to run binaries that were linked dynamically with libpng 1.0.x.

oval:org.secpod.oval:def:400775
ntp was updated to version 4.2.8p6 to fix 12 security issues. Also yast2-ntp-client was updated to match some sntp syntax changes. These security issues were fixed: - CVE-2015-8158: Fixed potential infinite loop in ntpq . - CVE-2015-8138: Zero Origin Timestamp Bypass . - CVE-2015-7979: Off-path Den ...

oval:org.secpod.oval:def:204167
The Network Time Protocol is used to synchronize a computer"s time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service. Security Fix: * It was found that the fix for CVE-2014-9 ...

oval:org.secpod.oval:def:110183
The Network Time Protocol is used to synchronize a computer"s time with another reference time source. This package includes ntpd and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl package, ntpdate is in the ntpdate package and sntp is ...

oval:org.secpod.oval:def:400676
ntp was updated to version 4.2.8p6 to fix 28 security issues. Major functional changes: - The "sntp" commandline tool changed its option handling in a major way, some options have been renamed or dropped. - "controlkey 1" is added during update to ntp.conf to allow sntp to work. ...

oval:org.secpod.oval:def:1501664
The Network Time Protocol is used to synchronize a computer"s time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service. Security Fix: * It was found that when NTP was configure ...

oval:org.secpod.oval:def:501930
The Network Time Protocol is used to synchronize a computer"s time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service. Security Fix: * It was found that the fix for CVE-2014-9 ...

oval:org.secpod.oval:def:109976
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream o ...

oval:org.secpod.oval:def:109791
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream o ...

oval:org.secpod.oval:def:702874
libxml2: GNOME XML library libxml2 could be made to crash if it opened a specially crafted file.

oval:org.secpod.oval:def:501719
The libxml2 library is a development toolbox providing the implementation of various XML standards. Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HT ...

oval:org.secpod.oval:def:602320
Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive am ...

oval:org.secpod.oval:def:501720
The libxml2 library is a development toolbox providing the implementation of various XML standards. Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HT ...

oval:org.secpod.oval:def:204176
The libxml2 library is a development toolbox providing the implementation of various XML standards. Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HT ...

oval:org.secpod.oval:def:1200024
A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory.The xmlParseConditionalSections func ...

oval:org.secpod.oval:def:1501264
libxml2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-termin ...

oval:org.secpod.oval:def:1501265
libxml2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-termin ...

oval:org.secpod.oval:def:203780
The libxml2 library is a development toolbox providing the implementation of various XML standards. Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HT ...

oval:org.secpod.oval:def:34243
The host is installed with OpenSSH through 7.2p2 and is prone to a privilege escalation vulnerability. A flaw is present in session.c in sshd, which fails to handle an LD_PRELOAD environment variable. Successful exploitation could allow local users to gain privileges by triggering a crafted environm ...

oval:org.secpod.oval:def:110422
SSH is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over the sec ...

oval:org.secpod.oval:def:602292
Michal Kowalczyk discovered that missing input sanitising in the foomatic-rip print filter might result in the execution of arbitrary commands. The oldstable distribution is not affected.

oval:org.secpod.oval:def:34610
openssh: secure shell for secure access to remote machines Several security issues were fixed in OpenSSH.

oval:org.secpod.oval:def:1600474
It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running the login program. In configurations with UseLogin=yes and the pam_env PAM module configured to read user environment settings, a local user could use this flaw to execute arbitrary code as root.

oval:org.secpod.oval:def:702870
cups-filters: OpenPrinting CUPS Filters cups-filters could be made to run programs as the lp user if it processed a specially crafted print job.

oval:org.secpod.oval:def:703098
openssh: secure shell for secure access to remote machines Several security issues were fixed in OpenSSH.

oval:org.secpod.oval:def:110559
SSH is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over the sec ...

oval:org.secpod.oval:def:37886
The host is missing a patch containing security fixes, which affects the following package(s):openssh.base.server and openssh.base.client

oval:org.secpod.oval:def:204126
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix: * It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running t ...

oval:org.secpod.oval:def:602467
Shayan Sadigh discovered a vulnerability in OpenSSH: If PAM support is enabled and the sshd PAM configuration is configured to read user- specified environment variables and the "UseLogin" option is enabled, a local user may escalate her privileges to root. In Debian "UseLogin" i ...

oval:org.secpod.oval:def:1501810
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix: * It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running t ...

oval:org.secpod.oval:def:1501654
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix: * It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running t ...

oval:org.secpod.oval:def:702869
foomatic-filters: OpenPrinting printer support - filters foomatic-filters could be made to run programs as the lp user if it processed a specially crafted print job.

oval:org.secpod.oval:def:501928
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix: * It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running t ...

oval:org.secpod.oval:def:501995
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix: * It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running t ...

oval:org.secpod.oval:def:501725
The libpng packages contain a library of functions for creating and manipulating PNG image format files. It was discovered that the png_get_PLTE and png_set_PLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to ...

oval:org.secpod.oval:def:501734
The libpng12 packages contain a library of functions for creating and manipulating PNG image format files. It was discovered that the png_get_PLTE and png_set_PLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried t ...

oval:org.secpod.oval:def:1200129
It was discovered that the png_get_PLTE and png_set_PLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer ove ...

oval:org.secpod.oval:def:204198
The libpng12 packages contain a library of functions for creating and manipulating PNG image format files. It was discovered that the png_get_PLTE and png_set_PLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried t ...

oval:org.secpod.oval:def:203786
The libpng packages contain a library of functions for creating and manipulating PNG image format files. It was discovered that the png_get_PLTE and png_set_PLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to ...

oval:org.secpod.oval:def:602301
Takeshi Terada discovered a vulnerability in PHPMailer, a PHP library for email transfer, used by many CMSs. The library accepted email addresses and SMTP commands containing line breaks, which can be abused by an attacker to inject messages.

oval:org.secpod.oval:def:110135
Full Featured Email Transfer Class for PHP. PHPMailer features: * Supports emails digitally signed with S/MIME encryption! * Supports emails with multiple TOs, CCs, BCCs and REPLY-TOs * Works on any platform. * Supports Text & HTML emails. * Embedded image support. * Multipart/alternative emails ...

oval:org.secpod.oval:def:109859
The libpng12 package provides libpng 1.2, an older version of the libpng library for manipulating PNG image format files. This version should be used only if you are unable to use the current version of libpng.

oval:org.secpod.oval:def:109917
The libpng12 package provides libpng 1.2, an older version of the libpng library for manipulating PNG image format files. This version should be used only if you are unable to use the current version of libpng.

oval:org.secpod.oval:def:204097
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * It was found that the Linux kernel"s IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a deni ...

oval:org.secpod.oval:def:602435
Multiple vulnerabilities have been found in Redmine, a project management web application, which may result in information disclosure.

oval:org.secpod.oval:def:400752
This update for java-1_7_1-ibm fixes the following issues by updating to 7.1-3.30 : - CVE-2015-5041: Could could have invoked non-public interface methods under certain circumstances - CVE-2015-7575: The TLS protocol could allow weaker than expected security caused by a collision attack when using t ...

oval:org.secpod.oval:def:34892
The host is missing a patch containing a security fixes, which affects the following package(s): Java

oval:org.secpod.oval:def:1501659
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * It was found that the Linux kernel"s IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a deni ...

oval:org.secpod.oval:def:501901
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * It was found that the Linux kernel"s IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a deni ...

oval:org.secpod.oval:def:602427
Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure. The oldstable distribution will be updated in a separate DSA.

oval:org.secpod.oval:def:400709
xen was updated to fix 44 security issues. These security issues were fixed: - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm ima ...

oval:org.secpod.oval:def:602364
Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service, that could occur when receiving large packets. CVE-2015-7504 Qinghao Tang o ...

oval:org.secpod.oval:def:400737
xen was updated to fix 46 security issues. These security issues were fixed: - CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers . - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed r ...

oval:org.secpod.oval:def:400694
The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.62 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2014-9904: The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel did not properly check fo ...

oval:org.secpod.oval:def:602313
Adam Chester discovered that missing input sanitising in the foomatic-rip print filter might result in the execution of arbitrary commands.

oval:org.secpod.oval:def:602319
Michal Kowalczyk and Adam Chester discovered that missing input sanitising in the foomatic-rip print filter might result in the execution of arbitrary commands.

oval:org.secpod.oval:def:203886
Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. It was discovered that the unhtmlify function of f ...

oval:org.secpod.oval:def:109850
Contains backends, filters, and other software that was once part of the core CUPS distribution but is no longer maintained by Apple Inc. In addition it contains additional filters developed independently of Apple, especially filters for the PDF-centric printing workflow introduced by OpenPrinting.

oval:org.secpod.oval:def:702884
cups-filters: OpenPrinting CUPS Filters cups-filters could be made to run programs as the lp user if it processed a specially crafted print job.

oval:org.secpod.oval:def:702875
foomatic-filters: OpenPrinting printer support - filters foomatic-filters could be made to run programs as the lp user if it processed a specially crafted print job.

oval:org.secpod.oval:def:1501411
Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. It was discovered that the unhtmlify function of f ...

oval:org.secpod.oval:def:109903
Contains backends, filters, and other software that was once part of the core CUPS distribution but is no longer maintained by Apple Inc. In addition it contains additional filters developed independently of Apple, especially filters for the PDF-centric printing workflow introduced by OpenPrinting.

oval:org.secpod.oval:def:110087
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:501792
Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. It was discovered that the unhtmlify function of f ...

oval:org.secpod.oval:def:1600355
It was discovered that foomatic-rip failed to remove all shell special characters from inputs used to construct command lines for external programs run by the filter. An attacker could possibly use this flaw to execute arbitrary commands. It was discovered that the unhtmlify function of foomatic-rip ...

oval:org.secpod.oval:def:110121
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:400672
qemu was updated to fix 37 security issues. These security issues were fixed: - CVE-2016-4439: Avoid OOB access in 53C9X emulation - CVE-2016-4441: Avoid OOB access in 53C9X emulation - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation - CVE-2015-8817: Avoid OOB access in PCI DMA I/O - ...

oval:org.secpod.oval:def:400637
qemu was updated to fix 29 security issues. These security issues were fixed: - CVE-2016-4439: Avoid OOB access in 53C9X emulation - CVE-2016-4441: Avoid OOB access in 53C9X emulation - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation - CVE-2015-8817: Avoid OOB access in PCI dma I/O - ...

oval:org.secpod.oval:def:32820
qemu: Machine emulator and virtualizer - qemu-kvm: Machine emulator and virtualizer Several security issues were fixed in QEMU.

oval:org.secpod.oval:def:110079
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system , including a processor and various peripherials. It can be used to launch differe ...

oval:org.secpod.oval:def:110117
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system , including a processor and various peripherials. It can be used to launch differe ...

oval:org.secpod.oval:def:702942
perl: Practical Extraction and Report Language Perl incorrectly handled the taint attribute.

oval:org.secpod.oval:def:110085
This is the combined distribution for the File::Spec and Cwd modules.

oval:org.secpod.oval:def:110043
This is the combined distribution for the File::Spec and Cwd modules.

oval:org.secpod.oval:def:602327
David Golden of MongoDB discovered that File::Spec::canonpath in Perl returned untainted strings even if passed tainted input. This defect undermines taint propagation, which is sometimes used to ensure that unvalidated user input does not reach sensitive code. The oldstable distribution is not aff ...

oval:org.secpod.oval:def:602439
It was discovered that inspircd, an IRC daemon, incorrectly handled PTR lookups of connecting users. This flaw allowed a remote attacker to crash the application by setting up malformed DNS records, thus causing a denial-of-service,

oval:org.secpod.oval:def:502110
The glibc packages provide the standard C libraries , POSIX thread libraries , standard math libraries , and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix: * A stack overflow vulnerability was ...

oval:org.secpod.oval:def:1600762
Unbounded stack allocation in catopen functionA stack based buffer overflow vulnerability was found in the catopen function. An excessively long string passed to the function could cause it to crash or, potentially, execute arbitrary code.Integer overflow in hcreate and hcreate_rAn integer overflow ...

oval:org.secpod.oval:def:1501806
The glibc packages provide the standard C libraries , POSIX thread libraries , standard math libraries , and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix: * A stack overflow vulnerability was ...

oval:org.secpod.oval:def:502002
The glibc packages provide the standard C libraries , POSIX thread libraries , standard math libraries , and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix: * A stack overflow vulnerability was ...

oval:org.secpod.oval:def:703038
tiff: Tag Image File Format library LibTIFF could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:602365
Several vulnerabilities have been found in tiff, a Tag Image File Format library. Multiple out-of-bounds read and write flaws could cause an application using the tiff library to crash.

oval:org.secpod.oval:def:602394
It was discovered that php-horde-core, a set of classes providing the core functionality of the Horde Application Framework, is prone to a cross-site scripting vulnerability.

oval:org.secpod.oval:def:602471
It was discovered that fuseiso, a user-space implementation of the ISO 9660 file system based on FUSE, contains several vulnerabilities. CVE-2015-8836 A stack-based buffer overflow may allow attackers who can trick a user into mounting a crafted ISO 9660 file system to cause a denial of service , or ...

oval:org.secpod.oval:def:110434
MinGW Windows Poppler library.

oval:org.secpod.oval:def:110426
MinGW Windows Poppler library.

oval:org.secpod.oval:def:1600478
A heap-buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler to crash or, potentially, execute arbitrary code when opened.

oval:org.secpod.oval:def:703065
poppler: PDF rendering library poppler could be made to crash or run programs if it opened a specially crafted file.

oval:org.secpod.oval:def:204137
Poppler is a Portable Document Format rendering library, used by applications such as Evince. Security Fix: * A heap-buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler to crash or, potentially, execute arbi ...

oval:org.secpod.oval:def:602488
It was discovered that a heap overflow in the Poppler PDF library may result in denial of service and potentially the execution of arbitrary code if a malformed PDF file is opened.

oval:org.secpod.oval:def:1501657
Poppler is a Portable Document Format rendering library, used by applications such as Evince. Security Fix: * A heap-buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler to crash or, potentially, execute arbi ...

oval:org.secpod.oval:def:501900
Poppler is a Portable Document Format rendering library, used by applications such as Evince. Security Fix: * A heap-buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler to crash or, potentially, execute arbi ...

oval:org.secpod.oval:def:110878
The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the fo ...

oval:org.secpod.oval:def:1600430
A stack consumption vulnerability in GD in PHP allows remote attackers to cause a denial of service via a crafted imagefilltoborder call. An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2 function of PHP"s gd extension. A remote attacker could use this ...

oval:org.secpod.oval:def:37386
gdk-pixbuf: GDK-Pixbuf library GDK-PixBuf could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:602522
Several vulnerabilities have been discovered in gdk-pixbuf, a toolkit for image loading and pixel buffer manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using gdk-pixbuf , or potentially, to execute arbitrary code with the privile ...

oval:org.secpod.oval:def:110782
The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the fo ...

oval:org.secpod.oval:def:111203
DBD::mysql is the Perl5 Database Interface driver for the MySQL database. In other words: DBD::mysql is an interface between the Perl programming language and the MySQL programming API that comes with the MySQL relational database management system.

oval:org.secpod.oval:def:602577
Two use-after-free vulnerabilities were discovered in DBD::mysql, a Perl DBI driver for the MySQL database server. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using DBD::mysql , or potentially to execute arbitrary code with the privileges o ...

oval:org.secpod.oval:def:602668
Nicolas Braud-Santoni discovered that incorrect sanitising of character escape sequences in the Terminology terminal emulator may result in the execution of arbitrary commands.

oval:org.secpod.oval:def:602719
Gjoko Krstic of Zero Science Labs discovered that dcmtk, a collection of libraries implementing the DICOM standard, did not properly handle the size of data received the network. This could lead to denial-of-service or arbitrary code execution.

oval:org.secpod.oval:def:32670
The host is installed with Oracle VM VirtualBox from 4.3.x before 4.3.36 or 5.0.x and before 5.0.14 and is prone to unspecified vulnerability. A flaw is present in the application, which fails to handle vectors related to core. Successful exploitation could allows local users to affect availability

oval:org.secpod.oval:def:702944
mysql-5.6: MySQL database - mysql-5.5: MySQL database Several security issues were fixed in MySQL.

oval:org.secpod.oval:def:602353
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.47

oval:org.secpod.oval:def:602351
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.23. Please see the MariaDB 10.0 Release Notes for further details: https://mariadb.com/kb/en/mariadb/mariadb-10023-release-notes/

oval:org.secpod.oval:def:602352
Multiple vulnerabilities have been discovered in VirtualBox, an x86 virtualisation solution. Upstream support for the 4.1 release series has ended and since no information is available which would allow backports of isolated security fixes, security support for virtualbox in wheezy/oldstable needed ...

oval:org.secpod.oval:def:1501545
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: mariadb . Security Fix: * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws c ...

oval:org.secpod.oval:def:1600404
A double-free flaw was found in the way OpenSSL parsed certain malformed DSA private keys. An attacker could create specially crafted DSA private keys that, when processed by an application compiled against OpenSSL, could cause the application to crash. The ssl_verify_server_cert function in sql-co ...

oval:org.secpod.oval:def:1600443
It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. Unspecified vuln ...

oval:org.secpod.oval:def:703059
mysql-5.7: MySQL database Several security issues were fixed in MySQL.

oval:org.secpod.oval:def:703057
mysql-5.6: MySQL database - mysql-5.5: MySQL database Several security issues were fixed in MySQL.

oval:org.secpod.oval:def:110496
MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

oval:org.secpod.oval:def:203985
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: mariadb . Security Fix: * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws c ...

oval:org.secpod.oval:def:110547
MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

oval:org.secpod.oval:def:400733
mariadb was updated to version 10.0.25 to fix 25 security issues. These security issues were fixed: - CVE-2016-0505: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Options . - CVE-2016-0546: Unspecified vulnerability allowed local u ...

oval:org.secpod.oval:def:602526
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.25. Please see the MariaDB 10.0 Release Notes for further details: https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/ https://mariad ...

oval:org.secpod.oval:def:602477
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.49

oval:org.secpod.oval:def:501862
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: mariadb . Security Fix: * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws c ...

oval:org.secpod.oval:def:1501599
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application dep ...

oval:org.secpod.oval:def:204021
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicio ...

oval:org.secpod.oval:def:602436
Multiple security vulnerabilities have been fixed in the Tomcat servlet and JSP engine, which may result on bypass of security manager restrictions, information disclosure, denial of service or session fixation.

oval:org.secpod.oval:def:400782
This update for tomcat fixes the following issues: Tomcat 8 was updated from 8.0.23 to 8.0.32, to fix bugs and security issues. Fixed security issues: * CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat allowed remote authenticated users to bypass intended Securit ...

oval:org.secpod.oval:def:1600336
ResourceLinkFactory.setGlobalContext is a public method and was discovered to be accessible by web applications running under a security manager without any checks. This allowed a malicious web application to inject a malicious global context that could in turn be used to disrupt other web applicati ...

oval:org.secpod.oval:def:1600357
ResourceLinkFactory.setGlobalContext is a public method and was discovered to be accessible by web applications running under a security manager without any checks. This allowed a malicious web application to inject a malicious global context that could in turn be used to disrupt other web applicati ...

oval:org.secpod.oval:def:1600384
A directory traversal vulnerability in RequestUtil.java was discovered which allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths cal ...

oval:org.secpod.oval:def:501881
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicio ...

oval:org.secpod.oval:def:602469
Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in information disclosure, the bypass of CSRF protections and bypass of the SecurityManager.

oval:org.secpod.oval:def:33120
The host is installed with Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68 or 8.x before 8.0.31 and is prone to a security bypass vulnerability. A flaw is present in the application, which does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedSe ...

oval:org.secpod.oval:def:400638
This update for tomcat fixes the following security issues. Tomcat has been updated from 7.0.55 to 7.0.68. * CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat allowed remote authenticated users to bypass intended SecurityManager restrictions and list a parent dire ...

oval:org.secpod.oval:def:33119
The host is installed with Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68 or 8.x before 8.0.31 and is prone to a security bypass vulnerability. A flaw is present in the session-persistence implementation, which mishandles session attributes. Successful exploitation allows remote authenticated us ...

oval:org.secpod.oval:def:110858
This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parsed. ...

oval:org.secpod.oval:def:1600483
CVE-2016-0718 : Out-of-bounds read flaw An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary ...

oval:org.secpod.oval:def:204045
Expat is a C library for parsing XML documents. Security Fix: * An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, pos ...

oval:org.secpod.oval:def:36575
The host is missing an important security update according to Mozilla advisory, MFSA2016-68. The update is required to fix an out-of-bounds read vulnerability. A flaw is present in the application, which fail to handle malformed XML data. Successful exploitation allows remote attackers to read other ...

oval:org.secpod.oval:def:400755
This update for expat fixes the following issues: Security issue fixed: - CVE-2016-0718: Fix Expat XML parser that mishandles certain kinds of malformed input documents. - CVE-2015-1283: Fix multiple integer overflows

oval:org.secpod.oval:def:204140
Expat is a C library for parsing XML documents. Security Fix: * An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, pos ...

oval:org.secpod.oval:def:602506
Gustavo Grieco discovered that Expat, an XML parsing C library, does not properly handle certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. A remote attacker can take advantage of this flaw to cause an application using the Expat library ...

oval:org.secpod.oval:def:703172
xmlrpc-c: Lightweight RPC library based on XML and HTTP Several security issues were fixed in XML-RPC for C and C++.

oval:org.secpod.oval:def:703112
expat: XML parsing C library Expat could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:110629
This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parsed. ...

oval:org.secpod.oval:def:36618
The host is missing an important security update according to Mozilla advisory, MFSA2016-68. The update is required to fix an out-of-bounds read vulnerability. A flaw is present in the application, which fail to handle malformed XML data. Successful exploitation allows remote attackers to read other ...

oval:org.secpod.oval:def:1501684
Expat is a C library for parsing XML documents. Security Fix: * An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, pos ...

oval:org.secpod.oval:def:1501685
Expat is a C library for parsing XML documents. Security Fix: * An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, pos ...

oval:org.secpod.oval:def:34942
The host is installed with RHEL 6 or 7 and is prone to an out-of-bounds heap read vulnerability. A flaw is present in the application, which fails to handle a malformed input document. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:501941
Expat is a C library for parsing XML documents. Security Fix: * An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, pos ...

oval:org.secpod.oval:def:703220
firefox: Mozilla Open Source web browser Firefox could be made to crash or run programs as your login if it opened a malicious website.

oval:org.secpod.oval:def:110714
This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parsed. ...

oval:org.secpod.oval:def:110830
Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0 recom ...

oval:org.secpod.oval:def:110817
Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0 recom ...

oval:org.secpod.oval:def:110809
Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0 recom ...

oval:org.secpod.oval:def:702983
libssh: A tiny C SSH library Several security issues were fixed in libssh.

oval:org.secpod.oval:def:702962
nginx: small, powerful, scalable web/proxy server Several security issues were fixed in nginx.

oval:org.secpod.oval:def:502174
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix: * A type confusion issue was found in the way libssh generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would ...

oval:org.secpod.oval:def:110099
Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage.

oval:org.secpod.oval:def:602371
Several vulnerabilities were discovered in the resolver in nginx, a small, powerful, scalable web/proxy server, leading to denial of service or, potentially, to arbitrary code execution. These only affect nginx if the "resolver" directive is used in a configuration file.

oval:org.secpod.oval:def:602393
Multiple security vulnerabilities have been found in Pillow, a Python imaging library, which may result in denial of service or the execution of arbitrary code if a malformed FLI, PCD or Tiff files is processed.

oval:org.secpod.oval:def:602384
Aris Adamantiadis discovered that libssh, a tiny C SSH library, incorrectly generated a short ephemeral secret for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. The resulting secret is 128 bits long, instead of the recommended sizes of 1024 and 2048 bits respectively. Th ...

oval:org.secpod.oval:def:1600371
It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if nginx enabled the resolver in its configuratio ...

oval:org.secpod.oval:def:110128
Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage.

oval:org.secpod.oval:def:110140
Python image processing library, fork of the Python Imaging Library This library provides extensive file format support, an efficient internal representation, and powerful image processing capabilities. There are four subpackages: tk , qt , devel and doc .

oval:org.secpod.oval:def:110205
Python image processing library, fork of the Python Imaging Library This library provides extensive file format support, an efficient internal representation, and powerful image processing capabilities. There are four subpackages: tk , qt , devel and doc .

oval:org.secpod.oval:def:110223
The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote prog ...

oval:org.secpod.oval:def:110287
The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote prog ...

oval:org.secpod.oval:def:703284
pillow: Python Imaging Library compatibility layer Pillow could be made to crash if it received specially crafted input or opened a specially crafted file.

oval:org.secpod.oval:def:111219
The Simple Protocol for Independent Computing Environments is a remote display system built for virtual environments which allows you to view a computing 'desktop' environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine a ...

oval:org.secpod.oval:def:110890
The Simple Protocol for Independent Computing Environments is a remote display system built for virtual environments which allows you to view a computing 'desktop' environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine a ...

oval:org.secpod.oval:def:1501490
The Simple Protocol for Independent Computing Environments is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtu ...

oval:org.secpod.oval:def:602424
Two vulnerabilities have been discovered in Rails, a web application framework written in Ruby. Both vulnerabilities affect Action Pack, which handles the web requests for Rails. CVE-2016-2097 Crafted requests to Action View, one of the components of Action Pack, might result in rendering files from ...

oval:org.secpod.oval:def:1501489
The Simple Protocol for Independent Computing Environments is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtu ...

oval:org.secpod.oval:def:203946
The Simple Protocol for Independent Computing Environments is a remote display system built for virtual environments which allows the user to view a computing "desktop" environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine arch ...

oval:org.secpod.oval:def:203945
The Simple Protocol for Independent Computing Environments is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtu ...

oval:org.secpod.oval:def:501835
The Simple Protocol for Independent Computing Environments is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtu ...

oval:org.secpod.oval:def:501834
The Simple Protocol for Independent Computing Environments is a remote display system built for virtual environments which allows the user to view a computing "desktop" environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine arch ...

oval:org.secpod.oval:def:602528
Several vulnerabilities were discovered in spice, a SPICE protocol client and server library. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-0749 Jing Zhao of Red Hat discovered a memory allocation flaw, leading to a heap-based buffer overflow in spice"s ...

oval:org.secpod.oval:def:703168
spice: SPICE protocol client and server library Several security issues were fixed in Spice.

oval:org.secpod.oval:def:33121
The host is installed with Apache Tomcat 7.x before 7.0.68 or 8.x before 8.0.31 and is prone to a security bypass vulnerability. A flaw is present in the setGlobalContext method, which does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized. Successful exploitation allo ...

oval:org.secpod.oval:def:400664
The SUSE Linux Enterprise 12 kernel was updated to 3.12.60 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2014-9717: fs/namespace.c in the Linux kernel processes MNT_DETACH umount2 system called without verifying that the MNT_LOCKED flag is unset, which allow ...

oval:org.secpod.oval:def:110343
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:702964
postgresql-9.4: Object-relational SQL database - postgresql-9.3: Object-relational SQL database - postgresql-9.1: Object-relational SQL database PostgreSQL could be made to crash or run programs if it handled specially crafted data.

oval:org.secpod.oval:def:33740
The host is installed with PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, or 9.5.x before 9.5.1 and is prone to a privilege escalation vulnerability. A flaw is present in the application, which fails to properly restrict access to unspecified custom configura ...

oval:org.secpod.oval:def:602370
Several vulnerabilities have been found in PostgreSQL-9.1, a SQL database system. CVE-2015-5288 Josh Kupershmidt discovered a vulnerability in the crypt function in the pgCrypto extension. Certain invalid salt arguments can cause the server to crash or to disclose a few bytes of server memory. CVE-2 ...

oval:org.secpod.oval:def:602368
Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. CVE-2016-0766 A privilege escalation vulnerability for users of PL/Java was discovered. Certain custom configuration settings for PL/Java will now be modifiable only by the database superuser to mitigate this issue. C ...

oval:org.secpod.oval:def:400686
This update for postgresql93 fixes the following issues: - Security and bugfix release 9.3.11: * Fix infinite loops and buffer-overrun problems in regular expressions . * Fix regular-expression compiler to handle loops of constraint arcs . * Prevent certain PL/Java parameters from being set by non-s ...

oval:org.secpod.oval:def:33741
The host is installed with PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, or 9.5.x before 9.5.1 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to handle a large Unicode character range in a regular express ...

oval:org.secpod.oval:def:203860
PostgreSQL is an advanced object-relational database management system . An integer overflow flaw, leading to a heap-based buffer overflow, was found in the PostgreSQL handling code for regular expressions. A remote attacker could use a specially crafted regular expression to cause PostgreSQL to cra ...

oval:org.secpod.oval:def:203853
PostgreSQL is an advanced object-relational database management system . An integer overflow flaw, leading to a heap-based buffer overflow, was found in the PostgreSQL handling code for regular expressions. A remote attacker could use a specially crafted regular expression to cause PostgreSQL to cra ...

oval:org.secpod.oval:def:203852
PostgreSQL is an advanced object-relational database management system . An integer overflow flaw, leading to a heap-based buffer overflow, was found in the PostgreSQL handling code for regular expressions. A remote attacker could use a specially crafted regular expression to cause PostgreSQL to cra ...

oval:org.secpod.oval:def:1600400
An integer overflow flaw, leading to a heap-based buffer overflow, was found in the PostgreSQL handling code for regular expressions. A remote attacker could use a specially crafted regular expression to cause PostgreSQL to crash or possibly execute arbitrary code.

oval:org.secpod.oval:def:501774
PostgreSQL is an advanced object-relational database management system . An integer overflow flaw, leading to a heap-based buffer overflow, was found in the PostgreSQL handling code for regular expressions. A remote attacker could use a specially crafted regular expression to cause PostgreSQL to cra ...

oval:org.secpod.oval:def:501775
PostgreSQL is an advanced object-relational database management system . An integer overflow flaw, leading to a heap-based buffer overflow, was found in the PostgreSQL handling code for regular expressions. A remote attacker could use a specially crafted regular expression to cause PostgreSQL to cra ...

oval:org.secpod.oval:def:1600350
An integer overflow flaw, leading to a heap-based buffer overflow, was found in the PostgreSQL handling code for regular expressions. A remote attacker could use a specially crafted regular expression to cause PostgreSQL to crash or possibly execute arbitrary code.

oval:org.secpod.oval:def:110210
PostgreSQL is an advanced Object-Relational database management system . The base postgresql package contains the client programs that you"ll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the P ...

oval:org.secpod.oval:def:204270
The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel"s file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a conta ...

oval:org.secpod.oval:def:110230
PostgreSQL is an advanced Object-Relational database management system . The base postgresql package contains the client programs that you"ll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the P ...

oval:org.secpod.oval:def:703262
python-imaging: Python Imaging Library Python Imaging Library could be made to crash if it received specially crafted input or opened a specially crafted file.

oval:org.secpod.oval:def:203854
The libssh2 packages provide a library that implements the SSHv2 protocol. A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use signific ...

oval:org.secpod.oval:def:203856
The libssh2 packages provide a library that implements the SSHv2 protocol. A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use signific ...

oval:org.secpod.oval:def:501776
The libssh2 packages provide a library that implements the SSHv2 protocol. A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use signific ...

oval:org.secpod.oval:def:602380
Andreas Schneider reported that libssh2, a SSH2 client-side library, passes the number of bytes to a function that expects number of bits during the SSHv2 handshake when libssh2 is to get a suitable value for "group order" in the Diffie-Hellman negotiation. This weakens significantly the handshake s ...

oval:org.secpod.oval:def:1600379
A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters.

oval:org.secpod.oval:def:1501392
A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters.

oval:org.secpod.oval:def:1501391
A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters.

oval:org.secpod.oval:def:110280
libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS, SECSH-USERAUTH, SECSH-CONNECTION, SECSH-ARCH, SECSH-FILEXFER*, SECSH-DHGEX, and SECSH-NUMBERS.

oval:org.secpod.oval:def:110232
libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS, SECSH-USERAUTH, SECSH-CONNECTION, SECSH-ARCH, SECSH-FILEXFER*, SECSH-DHGEX, and SECSH-NUMBERS.

oval:org.secpod.oval:def:37854
The host is missing a security update according to Apple advisory, APPLE-SA-2016-10-27-1. The update is required to fix multiple arbitrary code execution vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation allows attackers to caus ...

oval:org.secpod.oval:def:602546
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2015-7515, CVE-2016-2184, CVE-2016-2185, CVE-2016-2186, CVE-2016-2187, CVE-2016-3136, CVE-2016-3137, CVE-2016-3138, CVE-2016-3140 Ralf Spenneberg of O ...

oval:org.secpod.oval:def:39003
squid3: Web proxy cache server Squid could be made to expose sensitive information over the network.

oval:org.secpod.oval:def:602715
Saulius Lapinskas from Lithuanian State Social Insurance Fund Board discovered that Squid3, a fully featured web proxy cache, does not properly process responses to If-None-Modified HTTP conditional requests, leading to client-specific Cookie data being leaked to other clients. A remote attacker can ...

oval:org.secpod.oval:def:204087
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix: * It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached request. A remote attacker could send a spec ...

oval:org.secpod.oval:def:204085
The squid34 packages provide version 3.4 of Squid, a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix: * It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached re ...

oval:org.secpod.oval:def:703456
squid3: Web proxy cache server Squid could be made to expose sensitive information over the network.

oval:org.secpod.oval:def:1501747
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix: * It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached request. A remote attacker could send a spec ...

oval:org.secpod.oval:def:1501748
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix: * It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached request. A remote attacker could send a spec ...

oval:org.secpod.oval:def:111919
Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DNS l ...

oval:org.secpod.oval:def:501969
The squid34 packages provide version 3.4 of Squid, a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix: * It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached re ...

oval:org.secpod.oval:def:501970
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix: * It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached request. A remote attacker could send a spec ...

oval:org.secpod.oval:def:703779
python-pysaml2: Pure python implementation of SAML2 The system could be made to expose sensitive information.

oval:org.secpod.oval:def:602757
Ibrahim M. El-Sayed discovered an out-of-bounds heap read vulnerability in the function Type_MLU_Read in liblcms2-2, the Little CMS 2 color management library, which can be triggered by an image with a specially crafted ICC profile and leading to a heap memory leak or denial-of-service for applicati ...

oval:org.secpod.oval:def:42454
The host is installed with Oracle Java SE through 7u151, 8u144 or 9 and is prone to an unspecified vulnerability. A flaw is present in the application, which fails to handle vectors related to 2D (Little CMS 2). Successful exploitation allows attackers to affect Confidentiality.

oval:org.secpod.oval:def:502028
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 52.1.0. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute a ...

oval:org.secpod.oval:def:40402
The host is missing a critical security update according to Mozilla advisory, MFSA2017-13. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to execute arbitrary code o ...

oval:org.secpod.oval:def:40407
The host is missing a critical security update according to Mozilla advisory, MFSA2017-13. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to execute arbitrary code o ...

oval:org.secpod.oval:def:602775
Several vulnerabilities were discovered in libevent, an asynchronous event notification library. They would lead to Denial Of Service via application crash, or remote code execution.

oval:org.secpod.oval:def:40091
The host is missing a critical security update according to Mozilla advisory, MFSA2017-10. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to execute arbitrary code o ...

oval:org.secpod.oval:def:40092
The host is missing a critical security update according to Mozilla advisory, MFSA2017-11. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to execute arbitrary code o ...

oval:org.secpod.oval:def:40093
The host is missing a critical security update according to Mozilla advisory, MFSA2017-12. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to execute arbitrary code o ...

oval:org.secpod.oval:def:40099
Mozilla Firefox before 53.0, Thunderbird before 52.1, Firefox ESR before 45.9 or 52.x before 52.1 :- Three vulnerabilities were reported in the Libevent library that allow for out-of-bounds reads and denial of service (DoS) attacks: CVE-2016-10195, CVE-2016-10196, and CVE-2016-10197. These were fixe ...

oval:org.secpod.oval:def:40060
Mozilla Firefox before 53.0, Thunderbird before 52.1, Firefox ESR before 45.9 or 52.x before 52.1 :- Three vulnerabilities were reported in the Libevent library that allow for out-of-bounds reads and denial of service (DoS) attacks: CVE-2016-10195, CVE-2016-10196, and CVE-2016-10197. These were fixe ...

oval:org.secpod.oval:def:40131
The host is missing a critical security update according to Mozilla advisory, MFSA2017-11. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to execute arbitrary code o ...

oval:org.secpod.oval:def:40132
The host is missing a critical security update according to Mozilla advisory, MFSA2017-12. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to execute arbitrary code o ...

oval:org.secpod.oval:def:40130
The host is missing a critical security update according to Mozilla advisory, MFSA2017-10. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to execute arbitrary code o ...

oval:org.secpod.oval:def:1501852
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:1501850
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:204495
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 52.1.0. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute a ...

oval:org.secpod.oval:def:204492
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 52.1.0. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute a ...

oval:org.secpod.oval:def:703516
libevent: Asynchronous event notification library Several security issues were fixed in libevent.

oval:org.secpod.oval:def:703777
texlive-base: TeX Live: Essential programs and files TeX Live could be made to run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:602802
It was discovered that texlive-base, the TeX Live package which provides the essential TeX programs and files, whitelists mpost as an external program to be run from within the TeX source code . Since mpost allows to specify other programs to be run, an attacker can take advantage of this flaw for a ...

oval:org.secpod.oval:def:112210
The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font librari ...

oval:org.secpod.oval:def:110063
Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols.

oval:org.secpod.oval:def:110565
WebSVN offers a view onto your subversion repositories that's been designed to reflect the Subversion methodology. You can view the log of any file or directory and see a list of all the files changed, added or deleted in any given revision. You can also view the differences between two versions ...

oval:org.secpod.oval:def:602329
Two vulnerabilities were discovered in Prosody, a lightweight Jabber/XMPP server. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2016-1231 Kim Alvefur discovered a flaw in Prosody"s HTTP file-serving module that allows it to serve requests outside of the config ...

oval:org.secpod.oval:def:110558
WebSVN offers a view onto your subversion repositories that's been designed to reflect the Subversion methodology. You can view the log of any file or directory and see a list of all the files changed, added or deleted in any given revision. You can also view the differences between two versions ...

oval:org.secpod.oval:def:602460
Emmanuel Thome discovered that missing sanitising in the oarsh command of OAR, a software used to manage jobs and resources of HPC clusters, could result in privilege escalation.

oval:org.secpod.oval:def:602496
Nitin Venkatesh discovered that websvn, a web viewer for Subversion repositories, is susceptible to cross-site scripting attacks via specially crafted file and directory names in repositories.

oval:org.secpod.oval:def:111200
This module provides simple ways to query and possibly load any of the modules you have installed on your system during run-time.

oval:org.secpod.oval:def:111239
Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most comm ...

oval:org.secpod.oval:def:36409
The host is installed with Perl on RHEL 5, 6 or 7 and is prone to a privilege escalation vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploiation could allow attackers to access directories without permissions.

oval:org.secpod.oval:def:111189
This module provides simple ways to query and possibly load any of the modules you have installed on your system during run-time.

oval:org.secpod.oval:def:602570
Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-1238 John Lightsey and Todd Rinaldo reported that the opportunistic loading of optional modules can make many ...

oval:org.secpod.oval:def:703329
quagga: BGP/OSPF/RIP routing daemon Quagga could be made to crash if it received specially crafted network traffic.

oval:org.secpod.oval:def:703313
libdbd-mysql-perl: Perl5 database interface to the MySQL database DBD::mysql could be made to crash or run programs if it received specially crafted input.

oval:org.secpod.oval:def:111439
DBD::mysql is the Perl5 Database Interface driver for the MySQL database. In other words: DBD::mysql is an interface between the Perl programming language and the MySQL programming API that comes with the MySQL relational database management system.

oval:org.secpod.oval:def:111462
DBD::mysql is the Perl5 Database Interface driver for the MySQL database. In other words: DBD::mysql is an interface between the Perl programming language and the MySQL programming API that comes with the MySQL relational database management system.

oval:org.secpod.oval:def:602638
Paul Rohar discovered that libdbd-mysql-perl, the Perl DBI database driver for MySQL and MariaDB, constructed an error message in a fixed-length buffer, leading to a crash and, potentially, to denial of service.

oval:org.secpod.oval:def:602623
Tuomas Räsänen discovered two vulnerabilities in unADF, a tool to extract files from an Amiga Disk File dump : CVE-2016-1243 A stack buffer overflow in the function extractTree might allow an attacker, with control on the content of a ADF file, to execute arbitrary code with th ...

oval:org.secpod.oval:def:602646
It was discovered that the zebra daemon in the Quagga routing suite suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages.

oval:org.secpod.oval:def:602680
Florian Larysch and Bram Moolenaar discovered that vim, an enhanced vi editor, does not properly validate values for the the "filetype", "syntax" and "keymap" options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.

oval:org.secpod.oval:def:703368
vim: Vi IMproved - enhanced vi editor Vim could be made run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:1600486
A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user running vim

oval:org.secpod.oval:def:204062
Vim is an updated and improved version of the vi editor. Security Fix: * A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user runnin ...

oval:org.secpod.oval:def:204064
Vim is an updated and improved version of the vi editor. Security Fix: * A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user runnin ...

oval:org.secpod.oval:def:501950
Vim is an updated and improved version of the vi editor. Security Fix: * A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user runnin ...

oval:org.secpod.oval:def:1501708
Vim is an updated and improved version of the vi editor. Security Fix: * A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user running ...

oval:org.secpod.oval:def:1501712
Vim is an updated and improved version of the vi editor. Security Fix: * A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user running ...

oval:org.secpod.oval:def:702976
graphite2: Font rendering engine for Complex Scripts graphite2 could be made to crash or run programs as your login if it opened a specially crafted font.

oval:org.secpod.oval:def:203840
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Multiple security flaws were found in the graphite2 font library shipped with Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbi ...

oval:org.secpod.oval:def:203844
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Multiple security flaws were found in the graphite2 font library shipped with Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbi ...

oval:org.secpod.oval:def:203837
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Multiple security flaws were found in the graphite2 font library shipped with Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbi ...

oval:org.secpod.oval:def:32959
The host is installed with Mozilla Firefox before 43.0 or Firefox ESR 38.x before 38.6.1 and is prone to an information disclosure vulnerability. A flaw is present in the applications, which fail to handle a crafted graphite smart font. Successful exploitation allows remote attackers to obtain sensi ...

oval:org.secpod.oval:def:110484
Graphite2 is a project within SILs Non-Roman Script Initiative and Language Software Development groups to provide rendering capabilities for complex non-Roman writing systems. Graphite can be used to create smart fonts capable of displaying writing systems with various complex behaviors. With respe ...

oval:org.secpod.oval:def:501765
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Multiple security flaws were found in the graphite2 font library shipped with Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbi ...

oval:org.secpod.oval:def:602375
Multiple vulnerabilities have been found in the Graphite font rendering engine which might result in denial of service or the execution of arbitrary code if a malformed font file is processed.

oval:org.secpod.oval:def:602372
Holger Fuhrmannek discovered that missing input sanitising in the Graphite font rendering engine could result in the execution of arbitrary code.

oval:org.secpod.oval:def:1600340
Several vulnerabilities were discovered in Graphite2. An attacker able to trick an unsuspecting user into opening specially crafted font files in an application using Graphite2 could exploit these flaws to cause the application to crash or, potentially, execute arbitrary code with the privileges of ...

oval:org.secpod.oval:def:203906
Graphite2 is a project within SIL"s Non-Roman Script Initiative and Language Software Development groups to provide rendering capabilities for complex non-Roman writing systems. Graphite can be used to create "smart fonts" capable of displaying writing systems with various complex behavior ...

oval:org.secpod.oval:def:501800
Graphite2 is a project within SIL"s Non-Roman Script Initiative and Language Software Development groups to provide rendering capabilities for complex non-Roman writing systems. Graphite can be used to create "smart fonts" capable of displaying writing systems with various complex behavior ...

oval:org.secpod.oval:def:110173
Graphite2 is a project within SILs Non-Roman Script Initiative and Language Software Development groups to provide rendering capabilities for complex non-Roman writing systems. Graphite can be used to create smart fonts capable of displaying writing systems with various complex behaviors. With respe ...

oval:org.secpod.oval:def:1501343
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Multiple security flaws were found in the graphite2 font library shipped with Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbi ...

oval:org.secpod.oval:def:1501352
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Multiple security flaws were found in the graphite2 font library shipped with Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbi ...

oval:org.secpod.oval:def:1501351
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Multiple security flaws were found in the graphite2 font library shipped with Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbi ...

oval:org.secpod.oval:def:702940
ecryptfs-utils: eCryptfs cryptographic filesystem utilities mount.ecryptfs_private could be used to run programs as an administrator.

oval:org.secpod.oval:def:602343
Jann Horn discovered that the setuid-root mount.ecryptfs_private helper in the ecryptfs-utils would mount over any target directory that the user owns, including a directory in procfs. A local attacker could use this flaw to escalate his privileges.

oval:org.secpod.oval:def:110163
eCryptfs is a stacked cryptographic filesystem that ships in Linux kernel versions 2.6.19 and above. This package provides the mount helper and supporting libraries to perform key management and mount functions. Install ecryptfs-utils if you would like to mount eCryptfs.

oval:org.secpod.oval:def:110161
eCryptfs is a stacked cryptographic filesystem that ships in Linux kernel versions 2.6.19 and above. This package provides the mount helper and supporting libraries to perform key management and mount functions. Install ecryptfs-utils if you would like to mount eCryptfs.

oval:org.secpod.oval:def:110801
The kernel meta package

oval:org.secpod.oval:def:110812
The kernel meta package

oval:org.secpod.oval:def:204041
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * It was found that stacking a file system over procfs in the Linux kernel could lead to a kernel stack overflow due to deep nesting, as demonstrated by mounting ecryptfs over procfs and creating a re ...

oval:org.secpod.oval:def:204031
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * A race condition was found in the way the Linux kernel"s memory subsystem handled the copy-on-write breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to ...

oval:org.secpod.oval:def:501888
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * A race condition was found in the way the Linux kernel"s memory subsystem handled the copy-on-write breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to ...

oval:org.secpod.oval:def:1501666
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * It was found that stacking a file system over procfs in the Linux kernel could lead to a kernel stack overflow due to deep nesting, as demonstrated by mounting ecryptfs over procfs and creating a re ...

oval:org.secpod.oval:def:1501618
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on th ...

oval:org.secpod.oval:def:1501619
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on th ...

oval:org.secpod.oval:def:501933
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * It was found that stacking a file system over procfs in the Linux kernel could lead to a kernel stack overflow due to deep nesting, as demonstrated by mounting ecryptfs over procfs and creating a re ...

oval:org.secpod.oval:def:702978
oxide-qt: Web browser engine library for Qt Several security issues were fixed in Oxide.

oval:org.secpod.oval:def:32823
The host is installed with Google Chrome before 48.0.2564.109 and is prone to an arbitrary code execution vulnerability. A flaw is present in the application, which fails to handle a crafted JPEG 2000 image in a PDF document. Successful exploitation allows remote attackers to execute arbitrary code ...

oval:org.secpod.oval:def:32438
The host is installed with Google Chrome before 48.0.2564.109 and is prone to an arbitrary code execution vulnerability. A flaw is present in the application, which fails to handle a crafted JPEG 2000 image in a PDF document. Successful exploitation allows remote attackers to execute arbitrary code ...

oval:org.secpod.oval:def:32955
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a denial of service vulnerability. The flaw is present in the application, which fails to handle a crafted PDF document. Successful exploitation allows remote attackers to cause a denial of service (out-of-bounds read).

oval:org.secpod.oval:def:32954
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a security bypass vulnerability. The flaw is present in the application, which fails to handle unspecified vectors, related to instant_service.cc and search_tab_helper.cc. Successful exploitation allows remote attackers to ...

oval:org.secpod.oval:def:32957
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a security bypass vulnerability. The flaw is present in the application, which fails to handle a crafted URL, related to browser/devtools/devtools_ui_bindings.cc and WebKit/Source/devtools/front_end/Runtime.js. Successful ...

oval:org.secpod.oval:def:32956
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a denial of service vulnerability. The flaw is present in the application, which fails to handle a crafted PDF document. Successful exploitation allows remote attackers to cause a denial of service (out-of-bounds read).

oval:org.secpod.oval:def:32951
The host is installed with Google Chrome before 48.0.2564.109 and is prone to an integer underflow vulnerability. The flaw is present in the application, which fails to handle crafted data with brotli compression. Successful exploitation allows remote attackers to cause a denial of service (buffer o ...

oval:org.secpod.oval:def:32950
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a same origin policy bypass vulnerability. The flaw is present in the application, which fails to handle crafted web site, related to FrameLoader.cpp. Successful exploitation allows remote attackers to bypass the same orig ...

oval:org.secpod.oval:def:32953
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a security bypass vulnerability. The flaw is present in the application, which fails to handle unspecified vectors, related to instant_service.cc and search_tab_helper.cc. Successful exploitation allows remote attackers to ...

oval:org.secpod.oval:def:32952
The host is installed with Google Chrome before 48.0.2564.109 and is prone to an integer underflow vulnerability. The flaw is present in the application, which fails to handle crafted data with brotli compression. Successful exploitation allows remote attackers to cause a denial of service (buffer o ...

oval:org.secpod.oval:def:32958
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a security bypass vulnerability. The flaw is present in the application, which fails to handle a crafted URL, related to browser/devtools/devtools_ui_bindings.cc and WebKit/Source/devtools/front_end/Runtime.js. Successful ...

oval:org.secpod.oval:def:32944
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a security bypass vulnerability. The flaw is present in the application, which fails to handle a crafted URL, related to browser/devtools/devtools_ui_bindings.cc and WebKit/Source/devtools/front_end/Runtime.js. Successful ...

oval:org.secpod.oval:def:32943
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a denial of service vulnerability. The flaw is present in the application, which fails to handle a crafted PDF document. Successful exploitation allows remote attackers to cause a denial of service (out-of-bounds read).

oval:org.secpod.oval:def:32946
he host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to cause a denial of service, bypass the same origi ...

oval:org.secpod.oval:def:32945
he host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to cause a denial of service, bypass the same origi ...

oval:org.secpod.oval:def:32940
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a same origin policy bypass vulnerability. The flaw is present in the application, which fails to handle crafted web site, related to FrameLoader.cpp. Successful exploitation allows remote attackers to bypass the same orig ...

oval:org.secpod.oval:def:32942
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a security bypass vulnerability. The flaw is present in the application, which fails to handle unspecified vectors, related to instant_service.cc and search_tab_helper.cc. Successful exploitation allows remote attackers to ...

oval:org.secpod.oval:def:32941
The host is installed with Google Chrome before 48.0.2564.109 and is prone to an integer underflow vulnerability. The flaw is present in the application, which fails to handle crafted data with brotli compression. Successful exploitation allows remote attackers to cause a denial of service (buffer o ...

oval:org.secpod.oval:def:32948
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a same origin policy bypass vulnerability. The flaw is present in the application, which fails to handle a crafted javascript code. Successful exploitation allows remote attackers to bypass the same origin policy.

oval:org.secpod.oval:def:32947
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a same origin policy bypass vulnerability. The flaw is present in the application, which fails to handle a crafted javascript code. Successful exploitation allows remote attackers to bypass the same origin policy.

oval:org.secpod.oval:def:32949
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a same origin policy bypass vulnerability. The flaw is present in the application, which fails to handle crafted web site, related to FrameLoader.cpp. Successful exploitation allows remote attackers to bypass the same orig ...

oval:org.secpod.oval:def:32931
he host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to cause a denial of service, bypass the same origi ...

oval:org.secpod.oval:def:32939
The host is installed with Google Chrome before 48.0.2564.109 and is prone to a same origin policy bypass vulnerability. The flaw is present in the application, which fails to handle a crafted javascript code. Successful exploitation allows remote attackers to bypass the same origin policy.

oval:org.secpod.oval:def:32938
he host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to cause a denial of service, bypass the same origi ...

oval:org.secpod.oval:def:33051
The host is installed with Google Chrome before 48.0.2564.116 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows remote attackers to bypass the blink same origin policy and a sandbox protect ...

oval:org.secpod.oval:def:33050
The host is installed with Google Chrome before 48.0.2564.116 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows remote attackers to bypass the blink same origin policy and a sandbox protect ...

oval:org.secpod.oval:def:33053
he host is missing a security update according to Google advisory. The update is required to fix a security bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows remote attackers to bypass the blink same origin policy an ...

oval:org.secpod.oval:def:33052
The host is missing a security update according to Google advisory. The update is required to fix a security bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows remote attackers to bypass the blink same origin policy a ...

oval:org.secpod.oval:def:33055
The host is installed with Google Chrome before 48.0.2564.116 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows remote attackers to bypass the blink same origin policy and a sandbox protect ...

oval:org.secpod.oval:def:33054
The host is missing a security update according to Google advisory. The update is required to fix a security bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows remote attackers to bypass the blink same origin policy a ...

oval:org.secpod.oval:def:33049
The host is installed with Google Chrome before 48.0.2564.109 and is prone to an arbitrary code execution vulnerability. Aflaw is present in the application, which fails to handle a crafted JPEG 2000 image in a PDF document. Successful exploitation allows remote attackers to execute arbitrary code o ...

oval:org.secpod.oval:def:33048
The host is installed with Google Chrome before 48.0.2564.109 and is prone to an arbitrary code execution vulnerability. A flaw is present in the application, which fails to handle a crafted JPEG 2000 image in a PDF document. Successful exploitation allows remote attackers to execute arbitrary code ...

oval:org.secpod.oval:def:602381
Several vulnerabilities have been discovered in the chromium web browser. CVE-2016-1622 It was discovered that a maliciously crafted extension could bypass the Same Origin Policy. CVE-2016-1623 Mariusz Mlynski discovered a way to bypass the Same Origin Policy. CVE-2016-1624 lukezli discovered a buff ...

oval:org.secpod.oval:def:702993
oxide-qt: Web browser engine library for Qt Oxide could be made to bypass same-origin restrictions.

oval:org.secpod.oval:def:33738
The host is installed with Google Chrome before 49.0.2623.108 and is prone to an out-of-bounds vulnerability. A flaw is present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the browser, o ...

oval:org.secpod.oval:def:33732
The host is installed with Google Chrome before 49.0.2623.108 and is prone to an out-of-bounds vulnerability. A flaw is present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the browser, o ...

oval:org.secpod.oval:def:33731
The host is installed with Google Chrome before 49.0.2623.108 and is prone to an out-of-bounds vulnerability. A flaw is present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the browser, o ...

oval:org.secpod.oval:def:33736
The host is installed with Google Chrome before 49.0.2623.108 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the browser, ...

oval:org.secpod.oval:def:33735
The host is installed with Google Chrome before 49.0.2623.108 and is prone to a buffer-overflow vulnerability. A flaw is present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the browser, ...

oval:org.secpod.oval:def:33737
The host is installed with Google Chrome before 49.0.2623.108 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the browser, ...

oval:org.secpod.oval:def:33734
The host is installed with Google Chrome before 49.0.2623.108 and is prone to multiple unspecified vulnerabilities. The flaws are present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the ...

oval:org.secpod.oval:def:33733
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context ...

oval:org.secpod.oval:def:33730
The host is installed with Google Chrome before 49.0.2623.108 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the browser, ...

oval:org.secpod.oval:def:33725
The host is installed with Google Chrome before 49.0.2623.108 and is prone to a buffer-overflow vulnerability. A flaw is present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the browser, ...

oval:org.secpod.oval:def:33724
The host is installed with Google Chrome before 49.0.2623.108 and is prone to multiple unspecified vulnerabilities. The flaws are present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the ...

oval:org.secpod.oval:def:33727
The host is installed with Google Chrome before 49.0.2623.108 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the browser, ...

oval:org.secpod.oval:def:33726
The host is installed with Google Chrome before 49.0.2623.108 and is prone to a buffer-overflow vulnerability. A flaw is present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the browser, ...

oval:org.secpod.oval:def:33723
The host is installed with Google Chrome before 49.0.2623.108 and is prone to multiple unspecified vulnerabilities. The flaws are present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the ...

oval:org.secpod.oval:def:33729
The host is installed with Google Chrome before 49.0.2623.108 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the browser, ...

oval:org.secpod.oval:def:33728
The host is installed with Google Chrome before 49.0.2623.108 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context of the browser, ...

oval:org.secpod.oval:def:33714
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context ...

oval:org.secpod.oval:def:33715
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle a specially crafted web page. Successful exploitation allow an attacker to execute arbitrary code in the context ...

oval:org.secpod.oval:def:703071
oxide-qt: Web browser engine for Qt Several security issues were fixed in Oxide.

oval:org.secpod.oval:def:602437
Several vulnerabilities have been discovered in the chromium web browser. CVE-2016-1646 Wen Xu discovered an out-of-bounds read issue in the v8 library. CVE-2016-1647 A use-after-free issue was discovered. CVE-2016-1648 A use-after-free issue was discovered in the handling of extensions. CVE-2016-16 ...

oval:org.secpod.oval:def:34030
The host is installed with Google Chrome before 50.0.2661.75 and is prone to a cross-site scripting vulnerability. A flaw is present in the application, which fails to handle a crafted web site. Successful exploitation of this vulnerability allow remote attackers to inject arbitrary web script or HT ...

oval:org.secpod.oval:def:34031
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an out-of-bounds vulnerability. A flaw is present in the application, which fails to handle a crafted JavaScript code that triggers an out-of-bounds write operation. Successful exploitation of this vulnerability allow remot ...

oval:org.secpod.oval:def:34032
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an out-of-bounds vulnerability. A flaw is present in the application, which fails to handle a crafted JPEG 2000 data in a PDF document. Successful exploitation of this vulnerability allow remote attackers to obtain sensitiv ...

oval:org.secpod.oval:def:34017
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an out-of-bounds vulnerability. A flaw is present in the application, which fails to handle a crafted JPEG 2000 data in a PDF document. Successful exploitation of this vulnerability allow remote attackers to obtain sensitiv ...

oval:org.secpod.oval:def:34018
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an out-of-bounds vulnerability. A flaw is present in the application, which fails to handle a crafted JPEG 2000 data in a PDF document. Successful exploitation of this vulnerability allow remote attackers to obtain sensitiv ...

oval:org.secpod.oval:def:34015
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an out-of-bounds vulnerability. A flaw is present in the application, which fails to handle a crafted JavaScript code that triggers an out-of-bounds write operation. Successful exploitation of this vulnerability allow remot ...

oval:org.secpod.oval:def:34016
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an out-of-bounds vulnerability. A flaw is present in the application, which fails to handle a crafted JavaScript code that triggers an out-of-bounds write operation. Successful exploitation of this vulnerability allow remot ...

oval:org.secpod.oval:def:34013
The host is installed with Google Chrome before 50.0.2661.75 and is prone to a cross-site scripting vulnerability. A flaw is present in the application, which fails to handle a crafted web site. Successful exploitation of this vulnerability allow remote attackers to inject arbitrary web script or HT ...

oval:org.secpod.oval:def:34014
The host is installed with Google Chrome before 50.0.2661.75 and is prone to a cross-site scripting vulnerability. A flaw is present in the application, which fails to handle a crafted web site. Successful exploitation of this vulnerability allow remote attackers to inject arbitrary web script or HT ...

oval:org.secpod.oval:def:34035
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an address bar spoofing vulnerability. A flaw is present in the application, which fails to handle a crafted URL. Successful exploitation allows remote attackers to spoof the address bar.

oval:org.secpod.oval:def:34036
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to handle a crafted extension. Successful exploitation allows remote attackers to bypass the same origin policy and obtain sensitive ...

oval:org.secpod.oval:def:34033
The host is installed with Google Chrome before 50.0.2661.75 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to handle unknown vectors. Successful exploitation allows remote attackers to cause a denial of service (invalid read operation).

oval:org.secpod.oval:def:34034
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a crafted extension. Successful exploitation of this vulnerability allows remote attackers to cause a denial of service (use-after ...

oval:org.secpod.oval:def:34026
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to handle a crafted extension. Successful exploitation allows remote attackers to bypass the same origin policy and obtain sensitive ...

oval:org.secpod.oval:def:34024
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an address bar spoofing vulnerability. A flaw is present in the application, which fails to handle a crafted URL. Successful exploitation allows remote attackers to spoof the address bar.

oval:org.secpod.oval:def:34025
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to handle a crafted extension. Successful exploitation allows remote attackers to bypass the same origin policy and obtain sensitive ...

oval:org.secpod.oval:def:34022
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a crafted extension. Successful exploitation of this vulnerability allows remote attackers to cause a denial of service (use-after ...

oval:org.secpod.oval:def:34023
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an address bar spoofing vulnerability. A flaw is present in the application, which fails to handle a crafted URL. Successful exploitation allows remote attackers to spoof the address bar.

oval:org.secpod.oval:def:34020
The host is installed with Google Chrome before 50.0.2661.75 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to handle unknown vectors. Successful exploitation allows remote attackers to cause a denial of service (invalid read operation).

oval:org.secpod.oval:def:34021
The host is installed with Google Chrome before 50.0.2661.75 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a crafted extension. Successful exploitation of this vulnerability allows remote attackers to cause a denial of service (use-after ...

oval:org.secpod.oval:def:34019
The host is installed with Google Chrome before 50.0.2661.75 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to handle unknown vectors. Successful exploitation allows remote attackers to cause a denial of service (invalid read operation).

oval:org.secpod.oval:def:602468
Several vulnerabilities have been discovered in the chromium web browser. CVE-2016-1651 An out-of-bounds read issue was discovered in the pdfium library. CVE-2016-1652 A cross-site scripting issue was discovered in extension bindings. CVE-2016-1653 Choongwoo Han discovered an out-of-bounds write iss ...

oval:org.secpod.oval:def:34037
The host is installed with Google Chrome before 50.0.2661.75 and is prone to multiple unspecified vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation allow attackers to cause a denial service or possibly have other impact.

oval:org.secpod.oval:def:34028
The host is installed with Google Chrome before 50.0.2661.75 and is prone to multiple unspecified vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation allow attackers to cause a denial service or possibly have other impact.

oval:org.secpod.oval:def:34029
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle a specially crafted data. Successful exploitation allow an attacker to execute arbitrary code in the context of ...

oval:org.secpod.oval:def:34027
The host is installed with Google Chrome before 50.0.2661.75 and is prone to multiple unspecified vulnerabilities. The flaws are present in the application, which fails to handle unknown vectors. Successful exploitation allow attackers to cause a denial service or possibly have other impact.

oval:org.secpod.oval:def:34011
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle a specially crafted data. Successful exploitation allow an attacker to execute arbitrary code in the context of ...

oval:org.secpod.oval:def:34012
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle a specially crafted data. Successful exploitation allow an attacker to execute arbitrary code in the context of ...

oval:org.secpod.oval:def:37844
The host is installed with Xcode before 8.1 on Apple Mac OS X 10.11.5 or later and is prone to an arbitrary code execution vulnerability. A flaw is present in the Node.js, which fails to handle unknown vectors. Successful exploitation allows attackers to cause unexpected application termination or a ...

oval:org.secpod.oval:def:34392
The host is installed with Google Chrome before 50.0.2661.102 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to handle crafted JavaScript code. Successful exploitation allows remote attackers to cause a denial of service (buffer overflow) or poss ...

oval:org.secpod.oval:def:34390
The host is installed with Google Chrome before 50.0.2661.102 and is prone to a same origin policy bypass vulnerability. A flaw is present in the application, which fails to handle a crafted web site. Successful exploitation allows remote attackers to bypass the Same Origin Policy.

oval:org.secpod.oval:def:34391
The host is installed with Google Chrome before 50.0.2661.102 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to handle crafted JavaScript code. Successful exploitation allows remote attackers to cause a denial of service (buffer overflow) or poss ...

oval:org.secpod.oval:def:34398
The host is installed with Google Chrome before 50.0.2661.102 and is prone to a same origin policy bypass vulnerability. A flaw is present in the application, which fails to handle a crafted web site. Successful exploitation allows remote attackers to bypass the Same Origin Policy.

oval:org.secpod.oval:def:34399
The host is installed with Google Chrome before 50.0.2661.102 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to handle crafted JavaScript code. Successful exploitation allows remote attackers to cause a denial of service (buffer overflow) or poss ...

oval:org.secpod.oval:def:34396
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34397
The host is installed with Google Chrome before 50.0.2661.102 and is prone to a same origin policy bypass vulnerability. A flaw is present in the application, which fails to handle a crafted web site. Successful exploitation allows remote attackers to bypass the Same Origin Policy.

oval:org.secpod.oval:def:34395
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34389
The host is installed with Google Chrome before 50.0.2661.102 and is prone to a same origin policy bypass vulnerability. A flaw is present in the application, which fails to handle a crafted web site. Successful exploitation allows remote attackers to bypass the Same Origin Policy.

oval:org.secpod.oval:def:34387
The host is installed with Google Chrome before 50.0.2661.102 and is prone to a same origin policy bypass vulnerability. A flaw is present in the application, which fails to handle a crafted web site. Successful exploitation allows remote attackers to bypass the Same Origin Policy.

oval:org.secpod.oval:def:34388
The host is installed with Google Chrome before 50.0.2661.102 and is prone to a same origin policy bypass vulnerability. A flaw is present in the application, which fails to handle a crafted web site. Successful exploitation allows remote attackers to bypass the Same Origin Policy.

oval:org.secpod.oval:def:703118
oxide-qt: Web browser engine for Qt Several security issues were fixed in Oxide.

oval:org.secpod.oval:def:34401
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:111194
V8 is Google's open source JavaScript engine. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. V8 implements ECMAScript as specified in ECMA-262, 3rd edition.

oval:org.secpod.oval:def:111182
V8 is Google's open source JavaScript engine. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. V8 implements ECMAScript as specified in ECMA-262, 3rd edition.

oval:org.secpod.oval:def:34714
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a type confusion vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34712
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34713
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a type confusion vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34710
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34711
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34705
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34706
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34703
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34704
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34709
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34707
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34708
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34393
The host is installed with Google Chrome before 50.0.2661.102 and is prone to a race condition vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to make arbitrary HTTP requests.

oval:org.secpod.oval:def:34394
The host is installed with Google Chrome before 50.0.2661.102 and is prone to a race condition vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to make arbitrary HTTP requests.

oval:org.secpod.oval:def:34758
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a type confusion vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34756
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34757
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34754
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34755
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34753
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34400
The host is installed with Google Chrome before 50.0.2661.102 and is prone to a race condition vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation allows remote attackers to make arbitrary HTTP requests.

oval:org.secpod.oval:def:34720
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34716
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a heap based overflow vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34717
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34715
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a heap based overflow vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34718
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34719
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34763
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a CSP bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34761
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34762
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a heap based overflow vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34760
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34759
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a heap based overflow vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34723
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a CSP bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34724
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a CSP bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34721
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a heap based overflow vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34722
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a heap based overflow vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34738
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a heap buffer overflow vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34736
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34737
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a heap buffer overflow vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34734
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34735
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34732
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34733
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34730
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34731
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34729
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34770
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a heap buffer overflow vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34769
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34767
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34768
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34766
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34750
The host is installed with Google Chrome before 51.0.2704.63 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34749
The host is installed with Google Chrome before 51.0.2704.63 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34747
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an unspecified vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34748
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an unspecified vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34745
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34746
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34743
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34744
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34741
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a heap based buffer-overflow vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34742
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a heap based buffer-overflow vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34740
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34739
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34776
The host is installed with Google Chrome before 51.0.2704.63 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34774
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34775
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an unspecified vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34772
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a heap based buffer-overflow vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34773
The host is installed with Google Chrome before 51.0.2704.63 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34771
The host is installed with Google Chrome before 51.0.2704.63 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34895
The host is installed with Google Chrome before 51.0.2704.79 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34894
The host is installed with Google Chrome before 51.0.2704.79 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34912
The host is installed with Google Chrome before 51.0.2704.79 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:602525
Several vulnerabilities have been discovered in the chromium web browser. CVE-2016-1696 A cross-origin bypass was found in the bindings to extensions. CVE-2016-1697 Mariusz Mlynski discovered a cross-origin bypass in Blink/Webkit. CVE-2016-1698 Rob Wu discovered an information leak. CVE-2016-1699 Gr ...

oval:org.secpod.oval:def:34899
The host is installed with Google Chrome before 51.0.2704.79 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34897
The host is installed with Google Chrome before 51.0.2704.79 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34898
The host is installed with Google Chrome before 51.0.2704.79 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34896
The host is installed with Google Chrome before 51.0.2704.79 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34914
The host is installed with Google Chrome before 51.0.2704.79 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34915
The host is installed with Google Chrome before 51.0.2704.79 and is prone to a parameter sanitization failure vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34913
The host is installed with Google Chrome before 51.0.2704.79 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34910
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34911
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34918
The host is installed with Google Chrome before 51.0.2704.79 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34919
The host is installed with Google Chrome before 51.0.2704.79 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34916
The host is installed with Google Chrome before 51.0.2704.79 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34917
The host is installed with Google Chrome before 51.0.2704.79 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34903
The host is installed with Google Chrome before 51.0.2704.79 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34904
The host is installed with Google Chrome before 51.0.2704.79 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34901
The host is installed with Google Chrome before 51.0.2704.79 and is prone to a parameter sanitization failure vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34902
The host is installed with Google Chrome before 51.0.2704.79 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34900
The host is installed with Google Chrome before 51.0.2704.79 and is prone to a parameter sanitization failure vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34909
The host is installed with Google Chrome before 51.0.2704.79 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34907
The host is installed with Google Chrome before 51.0.2704.79 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34908
The host is installed with Google Chrome before 51.0.2704.79 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34905
The host is installed with Google Chrome before 51.0.2704.79 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34906
The host is installed with Google Chrome before 51.0.2704.79 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:34920
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:1501473
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system , including a processor and various peripherials. It can be used to launch differe ...

oval:org.secpod.oval:def:1501504
The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix: A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an appl ...

oval:org.secpod.oval:def:1501506
The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix: A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an appl ...

oval:org.secpod.oval:def:1600423
A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permission ...

oval:org.secpod.oval:def:112278
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream o ...

oval:org.secpod.oval:def:112275
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream o ...

oval:org.secpod.oval:def:203957
The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix: A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an appl ...

oval:org.secpod.oval:def:203956
The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix: A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an appl ...

oval:org.secpod.oval:def:400734
This update for libxml2 fixes the following security issues: - CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A Heap-buffer overread was fixed in libxml2/dict.c [bsc#963963, bsc#965283, bsc#981114]. - CVE-2016-4483: Code was added to avoid an out of bound access when serializing malformed strings [bsc ...

oval:org.secpod.oval:def:602524
Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial-of-service against the applica ...

oval:org.secpod.oval:def:703151
libxml2: GNOME XML library Several security issues were fixed in libxml2.

oval:org.secpod.oval:def:501844
The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix: A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an appl ...

oval:org.secpod.oval:def:34933
The host is installed with RHEL 6 or 7 and is prone to a heap-based buffer overread vulnerability. A flaw is present in the application, which fails to handle a crafted xml document. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:34934
The host is installed with RHEL 6 or 7 and is prone to a heap-based buffer overread vulnerability. A flaw is present in the application, which fails to handle a crafted xml document. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:34935
The host is installed with RHEL 6 or 7 and is prone to a heap-based buffer overflow vulnerability. A flaw is present in the application, which fails to handle a crafted xml document. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:34287
The host is installed with Apple iTunes before 12.4.2 and is prone to a memory corruption vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation allows attackers to crash the service.

oval:org.secpod.oval:def:35529
libxml2: GNOME XML library Several security issues were fixed in libxml2.

oval:org.secpod.oval:def:34941
The host is installed with RHEL 6 or 7 and is prone to a heap-based use-after-free vulnerability. A flaw is present in the application, which fails to handle a crafted xml document. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:34936
The host is installed with RHEL 6 or 7 and is prone to a heap-based use-after-free vulnerability. A flaw is present in the application, which fails to handle a crafted xml document. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:36255
The host is missing a security update according to Apple advisory APPLE-SA-2016-07-18-6. The update is required to fix multiple memory corruption vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows attackers to crash the servi ...

oval:org.secpod.oval:def:34937
The host is installed with RHEL 6 or 7 and is prone to a heap-based use-after-free vulnerability. A flaw is present in the application, which fails to handle a crafted xml document. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:34932
The host is installed with RHEL 6 or 7 and is prone to a heap-based buffer overflow vulnerability. A flaw is present in the application, which fails to handle a crafted xml document. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:34938
The host is installed with RHEL 6 or 7 and is prone to a heap-based buffer overread vulnerability. A flaw is present in the application, which fails to handle a crafted xml document. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:34939
The host is installed with RHEL 6 or 7 and is prone to a heap-based buffer overread vulnerability. A flaw is present in the application, which fails to handle a crafted xml document. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:502031
JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard. Security Fix: Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. Multiple flaws ...

oval:org.secpod.oval:def:602771
Multiple vulnerabilities have been discovered in the JasPer library for processing JPEG-2000 images, which may result in denial of service or the execution of arbitrary code if a malformed image is processed.

oval:org.secpod.oval:def:1501855
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:1501853
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:204498
JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard. Security Fix: Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. Multiple flaws ...

oval:org.secpod.oval:def:204496
JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard. Security Fix: Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. Multiple flaws ...

oval:org.secpod.oval:def:1600714
Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. Aspecially crafted file could cause an application using JasPer to crash or,possibly, execute arbitrary code. Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. Aspecially crafted file could cause an a ...

oval:org.secpod.oval:def:703615
jasper: Library for manipulating JPEG-2000 files Several security issues were fixed in JasPer.

oval:org.secpod.oval:def:602412
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library.

oval:org.secpod.oval:def:703042
libav: Multimedia player, server, encoder and transcoder Libav could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:602518
Two vulnerabilities were discovered in Symfony, a PHP framework. CVE-2016-1902 Lander Brandt discovered that the class SecureRandom might generate weak random numbers for cryptographic use under certain settings. If the functions random_bytes or openssl_random_pseudo_bytes are not available, the out ...

oval:org.secpod.oval:def:602611
Multiple vulnerabilities in OpenJPEG, a JPEG 2000 image compression / decompression library, may result in denial of service or the execution of arbitrary code if a malformed JPEG 2000 file is processed.

oval:org.secpod.oval:def:703011
thunderbird: Mozilla Open Source mail and newsgroup client Several security issues were fixed in Thunderbird.

oval:org.secpod.oval:def:602389
Multiple security issues have been found in Icedove, Debian"s version of the Mozilla Thunderbird mail client: Multiple memory safety errors, integer overflows, buffer overflows and other implementation errors may lead to the execution of arbitrary code or denial of service.

oval:org.secpod.oval:def:703212
thunderbird: Mozilla Open Source mail and newsgroup client Several security issues were fixed in Thunderbird.

oval:org.secpod.oval:def:1501440
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. A flaw was found in the way NSS verified certain ECDSA signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery ...

oval:org.secpod.oval:def:204166
Kernel-based Virtual Machine is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm packages provide the user-space component for running virtual machines using KVM. Security Fix: * An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU"s ...

oval:org.secpod.oval:def:1501650
Kernel-based Virtual Machine is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm packages provide the user-space component for running virtual machines using KVM. Security Fix: * An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU"s ...

oval:org.secpod.oval:def:501904
Kernel-based Virtual Machine is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm packages provide the user-space component for running virtual machines using KVM. Security Fix: * An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU"s ...

oval:org.secpod.oval:def:702988
cpio: a tool to manage archives of files Several security issues were fixed in GNU cpio.

oval:org.secpod.oval:def:602382
Gustavo Grieco discovered an out-of-bounds write vulnerability in cpio, a tool for creating and extracting cpio archive files, leading to a denial of service .

oval:org.secpod.oval:def:602399
Markus Krell discovered that xymon, a network- and applications-monitoring system, was vulnerable to the following security issues: CVE-2016-2054 The incorrect handling of user-supplied input in the "config" command can trigger a stack-based buffer overflow, resulting in denial of service ...

oval:org.secpod.oval:def:110837
Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0 recom ...

oval:org.secpod.oval:def:110831
Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0 recom ...

oval:org.secpod.oval:def:110820
Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0 recom ...

oval:org.secpod.oval:def:110327
Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn"t require a browser.

oval:org.secpod.oval:def:110319
Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn"t require a browser.

oval:org.secpod.oval:def:110307
Simple, battle-tested conventions and helpers for building web pages.

oval:org.secpod.oval:def:1501530
Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:203979
The kernel packages contain the Linux kernel, the core of any Linux operating system. These updated kernel packages include several security issues and numerous bug fixes, some of which you can see below. Space precludes documenting all of these bug fixes in this advisory. To see the complete list o ...

oval:org.secpod.oval:def:501857
The kernel packages contain the Linux kernel, the core of any Linux operating system. These updated kernel packages include several security issues and numerous bug fixes, some of which you can see below. Space precludes documenting all of these bug fixes in this advisory. To see the complete list o ...

oval:org.secpod.oval:def:35816
spice: SPICE protocol client and server library Several security issues were fixed in Spice.

oval:org.secpod.oval:def:110875
Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is publi ...

oval:org.secpod.oval:def:110851
Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is publi ...

oval:org.secpod.oval:def:602543
It was discovered that pdfbox, a PDF library for Java, was susceptible to XML External Entity attacks.

oval:org.secpod.oval:def:110779
OptiPNG is a PNG optimizer that recompresses image files to a smaller size, without losing any information. This program also converts external formats to optimized PNG, and performs PNG integrity checks and corrections.

oval:org.secpod.oval:def:110195
Taking a hint from the similarly-named Java Cryptography Architecture, QCA aims to provide a straightforward and cross-platform crypto API, using Qt datatypes and conventions. QCA separates the API from the implementation, using plugins known as Providers. The advantage of this model is to allow app ...

oval:org.secpod.oval:def:110192
Qt Creator is a cross-platform IDE tailored to the needs of Qt developers.

oval:org.secpod.oval:def:110175
Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \#10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API refere ...

oval:org.secpod.oval:def:110201
CodeEditor is a slimmed down, customized version of Qt Creator that focuses on bringing its text/code modern editing capabilities to users looking for just a simple and beautiful editor.

oval:org.secpod.oval:def:110208
monotone is a free, distributed version control system. It provides fully disconnected operation, manages complete tree versions, keeps its state in a local transactional database, supports overlapping branches and extensible metadata, exchanges work over plain network protocols, performs history-se ...

oval:org.secpod.oval:def:110248
Qt Creator is a cross-platform IDE tailored to the needs of Qt developers.

oval:org.secpod.oval:def:110247
Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \#10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API refere ...

oval:org.secpod.oval:def:110245
Taking a hint from the similarly-named Java Cryptography Architecture, QCA aims to provide a straightforward and cross-platform crypto API, using Qt datatypes and conventions. QCA separates the API from the implementation, using plugins known as Providers. The advantage of this model is to allow app ...

oval:org.secpod.oval:def:110244
monotone is a free, distributed version control system. It provides fully disconnected operation, manages complete tree versions, keeps its state in a local transactional database, supports overlapping branches and extensible metadata, exchanges work over plain network protocols, performs history-se ...

oval:org.secpod.oval:def:110242
CodeEditor is a slimmed down, customized version of Qt Creator that focuses on bringing its text/code modern editing capabilities to users looking for just a simple and beautiful editor.

oval:org.secpod.oval:def:602388
It was discovered that php-horde, a flexible, modular, general-purpose web application framework written in PHP, is prone to a cross-site scripting vulnerability.

oval:org.secpod.oval:def:110181
The Horde Application Framework is a flexible, modular, general-purpose web application framework written in PHP. It provides an extensive array of components that are targeted at the common problems and tasks involved in developing modern web applications. It is the basis for a large number of prod ...

oval:org.secpod.oval:def:110203
The Horde Application Framework is a flexible, modular, general-purpose web application framework written in PHP. It provides an extensive array of components that are targeted at the common problems and tasks involved in developing modern web applications. It is the basis for a large number of prod ...

oval:org.secpod.oval:def:110225
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:110259
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:33739
quagga: BGP/OSPF/RIP routing daemon Quagga could be made to crash or run programs if it received specially crafted network traffic.

oval:org.secpod.oval:def:110895
p7zip is a port of 7za.exe for Unix. 7-Zip is a file archiver with a very high compression ratio

oval:org.secpod.oval:def:602438
Kostya Kortchinsky discovered a stack-based buffer overflow vulnerability in the VPNv4 NLRI parser in bgpd in quagga, a BGP/OSPF/RIP routing daemon. A remote attacker can exploit this flaw to cause a denial of service , or potentially, execution of arbitrary code, if bgpd is configured with BGP peer ...

oval:org.secpod.oval:def:703037
quagga: BGP/OSPF/RIP routing daemon Quagga could be made to crash or run programs if it received specially crafted network traffic.

oval:org.secpod.oval:def:602532
Marcin "Icewall" Noga of Cisco Talos discovered an out-of-bound read vulnerability in the CInArchive::ReadFileItem method in p7zip, a 7zr file archiver with high compression ratio. A remote attacker can take advantage of this flaw to cause a denial-of-service or, potentially the execution of arbitra ...

oval:org.secpod.oval:def:602455
Marcin Noga discovered an integer underflow in Lhasa, a lzh archive decompressor, which might result in the execution of arbitrary code if a malformed archive is processed.

oval:org.secpod.oval:def:40380
The host is installed with Pidgin before 2.11.0 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to properly handle the MXIT protocol. Successful exploitation allows attackers to cause an application crash.

oval:org.secpod.oval:def:40381
The host is installed with Pidgin before 2.11.0 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to properly handle the MXIT protocol. Successful exploitation allows attackers to cause an application crash.

oval:org.secpod.oval:def:40384
The host is installed with Pidgin before 2.11.0 and is prone to a null pointer dereference vulnerability. A flaw is present in the application, which fails to properly handle the MXIT protocol. Successful exploitation allows attackers to potentially result in a denial of service.

oval:org.secpod.oval:def:40385
The host is installed with Pidgin before 2.11.0 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to properly handle the MXIT protocol. Successful exploitation allows attackers to send invalid data.

oval:org.secpod.oval:def:40382
The host is installed with Pidgin before 2.11.0 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to properly handle the MXIT protocol. Successful exploitation allows attackers to trigger an out-of-bounds read vulnerability.

oval:org.secpod.oval:def:40383
The host is installed with Pidgin before 2.11.0 and is prone to a memory corruption vulnerability. A flaw is present in the application, which fails to properly handle the MXIT protocol. Successful exploitation allows attackers to cause code execution or memory disclosure.

oval:org.secpod.oval:def:40388
The host is installed with Pidgin before 2.11.0 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to properly handle the MXIT protocol. Successful exploitation allows attackers to cause out-of-bounds read.

oval:org.secpod.oval:def:40389
The host is installed with Pidgin before 2.11.0 and is prone to a memory corruption vulnerability. A flaw is present in the application, which fails to properly handle the MXIT protocol. Successful exploitation allows attackers to cause an out-of-bounds write leading to memory disclosure and code ex ...

oval:org.secpod.oval:def:40386
The host is installed with Pidgin before 2.11.0 and is prone to a out-of-bounds write vulnerability. A flaw is present in the application, which fails to properly handle the MXIT protocol. Successful exploitation allows attackers to cause memory corruption resulting in code execution.

oval:org.secpod.oval:def:40387
The host is installed with Pidgin before 2.11.0 and is prone to a out-of-bounds read vulnerability. A flaw is present in the application, which fails to properly handle the MXIT protocol. Successful exploitation allows attackers to cause denial of service or copy data from memory to the file.

oval:org.secpod.oval:def:40391
The host is installed with Pidgin before 2.11.0 and is prone to a buffer overflow vulnerability. A flaw is present in the application, which fails to properly handle the MXIT data. Successful exploitation allows attackers to send an invalid size for a packet which will trigger a buffer overflow.

oval:org.secpod.oval:def:40392
The host is installed with Pidgin before 2.11.0 and is prone to a buffer overflow vulnerability. A flaw is present in the application, which fails to properly handle the MXIT data. Successful exploitation allows attackers to send a negative content-length in response to a HTTP request triggering the ...

oval:org.secpod.oval:def:40390
The host is installed with Pidgin before 2.11.0 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to properly handle the MXIT contact information. Successful exploitation allows attackers to cause an out-of-bounds read.

oval:org.secpod.oval:def:40393
The host is installed with Pidgin before 2.11.0 and is prone to a buffer overflow vulnerability. A flaw is present in the application, which fails to properly handle the MXIT data. Successful exploitation allows attackers to send negative length values to trigger this vulnerability.

oval:org.secpod.oval:def:602400
Stephane Chazelas discovered a bug in the environment handling in Perl. Perl provides a Perl-space hash variable, %ENV, in which environment variables can be looked up. If a variable appears twice in envp, only the last value would appear in %ENV, but getenv would return the first. Perl"s taint secu ...

oval:org.secpod.oval:def:703008
perl: Practical Extraction and Report Language Several security issues were fixed in Perl.

oval:org.secpod.oval:def:602447
Stelios Tsampas discovered a buffer overflow in the Kamailio SIP proxy which might result in the execution of arbitrary code.

oval:org.secpod.oval:def:40395
The host is installed with Pidgin before 2.11.0 and is prone to an out-of-bounds read vulnerability. A flaw is present in the application, which fails to properly handle a crafted MXIT data. Successful exploitation allows attackers to convince users to enter a particular string which would then get ...

oval:org.secpod.oval:def:110284
Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl"s hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl"s most common appli ...

oval:org.secpod.oval:def:110250
Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl"s hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl"s most common appli ...

oval:org.secpod.oval:def:602415
Alvaro Muñoz and Christian Schneider discovered that BeanShell, an embeddable Java source interpreter, could be leveraged to execute arbitrary commands: applications including BeanShell in their classpath are vulnerable to this flaw if they deserialize data from an untrusted source.

oval:org.secpod.oval:def:703015
bsh: Java scripting environment BeanShell could be made to run programs if it processed specially crafted input.

oval:org.secpod.oval:def:602386
Jakub Palaczynski discovered that websvn, a web viewer for Subversion repositories, does not correctly sanitize user-supplied input, which allows a remote user to run reflected cross-site scripting attacks.

oval:org.secpod.oval:def:110315
WebSVN offers a view onto your subversion repositories that"s been designed to reflect the Subversion methodology. You can view the log of any file or directory and see a list of all the files changed, added or deleted in any given revision. You can also view the differences between two versions of ...

oval:org.secpod.oval:def:110301
WebSVN offers a view onto your subversion repositories that"s been designed to reflect the Subversion methodology. You can view the log of any file or directory and see a list of all the files changed, added or deleted in any given revision. You can also view the differences between two versions of ...

oval:org.secpod.oval:def:400765
The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.57 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2015-8812: A flaw was found in the CXGB3 kernel driver when the network was considered congested. The kernel would incorrectly misinterpret the conge ...

oval:org.secpod.oval:def:34190
The host is installed with Mozilla Firefox before 46.0 or Firefox ESR 45.x before 45.1 and is prone to a memory corruption vulnerability. A flaw is present in the applications, which fail to handle unknown vectors. Successful exploitation allows remote attackers to execute arbitrary code or crash th ...

oval:org.secpod.oval:def:1501439
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.1.0 ESR. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with t ...

oval:org.secpod.oval:def:1501441
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.1.0 ESR. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with t ...

oval:org.secpod.oval:def:1501442
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.1.0 ESR. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with t ...

oval:org.secpod.oval:def:703064
firefox: Mozilla Open Source web browser Firefox could be made to crash or run programs as your login if it opened a malicious website.

oval:org.secpod.oval:def:703068
oxygen-gtk3: Oxygen widget theme for GTK3-based applications Details: USN-2936-1 fixed vulnerabilities in Firefox. The update caused Firefox to crash on startup with the Oxygen GTK theme due to a pre-existing bug in the Oxygen-GTK3 theme engine. This update fixes the problem. We apologize for the in ...

oval:org.secpod.oval:def:203923
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.1.0 ESR. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with t ...

oval:org.secpod.oval:def:203922
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.1.0 ESR. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with t ...

oval:org.secpod.oval:def:203921
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.1.0 ESR. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with t ...

oval:org.secpod.oval:def:501812
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.1.0 ESR. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with t ...

oval:org.secpod.oval:def:602540
Multiple security issues have been found in Icedove, Debian"s version of the Mozilla Thunderbird mail client: Multiple memory safety errors may lead to the execution of arbitrary code or denial of service. Debian follows the extended support releases of Thunderbird. Support for the 38.x series has ...

oval:org.secpod.oval:def:703113
firefox: Mozilla Open Source web browser Details: USN-2936-1 fixed vulnerabilities in Firefox. The update caused an issue where a device update POST request was sent every time about:preferences#sync was shown. This update fixes the problem. We apologize for the inconvenience. Original advisory USN- ...

oval:org.secpod.oval:def:1501512
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 45.2.0. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute a ...

oval:org.secpod.oval:def:1501513
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 45.2.0. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute a ...

oval:org.secpod.oval:def:203964
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 45.2.0. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute a ...

oval:org.secpod.oval:def:203962
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 45.2.0. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute a ...

oval:org.secpod.oval:def:203961
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 45.2.0. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute a ...

oval:org.secpod.oval:def:703157
firefox: Mozilla Open Source web browser Firefox could be made to crash or run programs as your login if it opened a malicious website.

oval:org.secpod.oval:def:501846
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 45.2.0. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute a ...

oval:org.secpod.oval:def:602589
Multiple security issues have been found in Icedove, Debian"s version of the Mozilla Thunderbird mail client: Multiple memory safety errors may lead to the execution of arbitrary code or denial of service.

oval:org.secpod.oval:def:1501491
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.2.0. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the p ...

oval:org.secpod.oval:def:1501492
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.2.0. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the p ...

oval:org.secpod.oval:def:1501493
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.2.0. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the p ...

oval:org.secpod.oval:def:203950
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.2.0 ESR. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with t ...

oval:org.secpod.oval:def:203949
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.2.0 ESR. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with t ...

oval:org.secpod.oval:def:203948
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.2.0 ESR. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with t ...

oval:org.secpod.oval:def:501836
Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 45.2.0 ESR. Security Fix: * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with t ...

oval:org.secpod.oval:def:602531
Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or spoofing. Wait, Firefox? No more references to Iceweasel? That"s right, Debian no longer applies ...

oval:org.secpod.oval:def:34962
The host is missing an important security update according to Mozilla advisory, MFSA2016-52. The update is required to fix an addressbar spoofing vulnerability. A flaw is present in the application, which fail to handle unknown vectors. Successful exploitation allows remote attackers to mask the tru ...

oval:org.secpod.oval:def:34967
The host is installed with Mozilla Firefox before 47.0 or Firefox ESR before 45.2 and is prone to a buffer overflow vulnerability. A flaw is present in the application, which fail to handle unknown vectors. Successful exploitation allows remote attackers to crash service.

oval:org.secpod.oval:def:34965
The host is installed with Mozilla Firefox before 47.0 or Firefox ESR before 45.2 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fail to handle unknown vectors. Successful exploitation allows remote attackers to crash service.

oval:org.secpod.oval:def:34966
The host is missing a critical security update according to Mozilla advisory, MFSA2016-50. The update is required to fix a buffer overflow vulnerability. A flaw is present in the application, which fail to handle unknown vectors. Successful exploitation allows remote attackers to crash service.

oval:org.secpod.oval:def:34963
The host is installed with Mozilla Firefox before 47.0 or Firefox ESR before 45.2 and is prone to an addressbar spoofing vulnerability. A flaw is present in the application, which fail to handle unknown vectors. Successful exploitation allows remote attackers to mask the true site URL, allowing for ...

oval:org.secpod.oval:def:34964
The host is missing an important security update according to Mozilla advisory, MFSA2016-51. The update is required to fix an use-after-free vulnerability. A flaw is present in the application, which fail to handle unknown vectors. Successful exploitation allows remote attackers to crash service.

oval:org.secpod.oval:def:34954
The host is missing an important security update according to Mozilla advisory, MFSA2016-56. The update is required to fix an use-after-free vulnerability. A flaw is present in the application, which fail to handle unknown vectors. Successful exploitation allows remote attackers to cause potentially ...

oval:org.secpod.oval:def:34955
The host is installed with Mozilla Firefox before 47.0 or Firefox ESR before 45.2 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fail to handle unknown vectors. Successful exploitation allows remote attackers to cause potentially exploitable crash when t ...

oval:org.secpod.oval:def:34950
The host is missing an important security update according to Mozilla advisory, MFSA2016-58. The update is required to fix a privilege escalation vulnerability. A flaw is present in the application, which fail to handle unknown vectors. Successful exploitation allows remote attackers to escalate per ...

oval:org.secpod.oval:def:34951
The host is installed with Mozilla Firefox before 47.0 or Firefox ESR before 45.2 and is prone to a privilege escalation vulnerability. A flaw is present in the application, which fail to handle unknown vectors. Successful exploitation allows remote attackers to escalate permissions, spoofing and cl ...

oval:org.secpod.oval:def:110546
Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \#10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API refere ...

oval:org.secpod.oval:def:110536
Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \#10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API refere ...

oval:org.secpod.oval:def:602482
Several security vulnerabilities were found in botan1.10, a C++ library which provides support for many common cryptographic operations, including encryption, authentication, X.509v3 certificates and CRLs. CVE-2015-5726 The BER decoder would crash due to reading from offset 0 of an empty vector if i ...

oval:org.secpod.oval:def:602409
Markus Vervier of X41 D-Sec GmbH discovered an integer overflow vulnerability in libotr, an off-the-record messaging library, in the way how the sizes of portions of incoming messages were stored. A remote attacker can exploit this flaw by sending crafted messages to an application that is using li ...

oval:org.secpod.oval:def:703019
libotr: Off-the-Record Messaging library OTR could be made to crash or run programs if it received specially crafted network traffic.

oval:org.secpod.oval:def:110326
Off-the-Record Messaging Library and Toolkit This is a library and toolkit which implements Off-the-Record Messaging. OTR allows you to have private conversations over IM by providing Encryption, Authentication, Deniability and Perfect forward secrecy.

oval:org.secpod.oval:def:110311
Off-the-Record Messaging Library and Toolkit This is a library and toolkit which implements Off-the-Record Messaging. OTR allows you to have private conversations over IM by providing Encryption, Authentication, Deniability and Perfect forward secrecy.

oval:org.secpod.oval:def:110390
Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects

oval:org.secpod.oval:def:1501444
Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects. Security Fix: * It was discovered that Mercurial failed to properly check Git sub-repository URLs. A Mercurial repository that includes a Git sub-repository with a sp ...

oval:org.secpod.oval:def:203924
Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects. Security Fix: * It was discovered that Mercurial failed to properly check Git sub-repository URLs. A Mercurial repository that includes a Git sub-repository with a sp ...

oval:org.secpod.oval:def:1600368
It was discovered that Mercurial failed to properly check Git sub-repository URLs. A Mercurial repository that includes a Git sub-repository with a specially crafted URL could cause Mercurial to execute arbitrary code. The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to exe ...

oval:org.secpod.oval:def:501814
Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects. Security Fix: * It was discovered that Mercurial failed to properly check Git sub-repository URLs. A Mercurial repository that includes a Git sub-repository with a sp ...

oval:org.secpod.oval:def:602537
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.7

oval:org.secpod.oval:def:602459
Several vulnerabilities have been discovered in Mercurial, a distributed version control system. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2016-3068 Blake Burkhart discovered that Mercurial allows URLs for Git subrepositories that could result in arbitrary ...

oval:org.secpod.oval:def:110454
The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the fo ...

oval:org.secpod.oval:def:110483
The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important sets ...

oval:org.secpod.oval:def:110531
The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the fo ...

oval:org.secpod.oval:def:1600383
The following security-related issues were resolved:Buffer over-write in finfo_open with malformed magic file Signedness vulnerability causing heap overflow in libgd Integer overflow in php_raw_url_encode Format string vulnerability in php_snmp_error Invalid memory write in phar on filename containi ...

oval:org.secpod.oval:def:703198
linux-lts-wily: Linux hardware enablement kernel from Wily for Trusty The system could be made to crash under certain conditions.

oval:org.secpod.oval:def:703197
linux: Linux kernel The system could be made to crash under certain conditions.

oval:org.secpod.oval:def:602539
Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. The vulnerabilities are addressed by upgrading PHP to the new upstream version 5.6.22, which includes additional bug fixes. Please refer to the upstream changelog for more i ...

oval:org.secpod.oval:def:703141
libgd2: GD Graphics Library The GD library could be made to crash or run programs if it processed a specially crafted image file.

oval:org.secpod.oval:def:703131
glibc: GNU C Library - eglibc: GNU C Library Several security issues were fixed in the GNU C Library.

oval:org.secpod.oval:def:703136
glibc: GNU C Library - eglibc: GNU C Library Details: USN-2985-1 fixed vulnerabilities in the GNU C Library. The fix for CVE-2014-9761 introduced a regression which affected applications that use the libm library but were not fully restarted after the upgrade. This update removes the fix for CVE-201 ...

oval:org.secpod.oval:def:602479
Hans Jerry Illikainen discovered that libgd2, a library for programmatic graphics creation and manipulation, suffers of a signedness vulnerability which may result in a heap overflow when processing specially crafted compressed gd2 data. A remote attacker can take advantage of this flaw to cause an ...

oval:org.secpod.oval:def:1501675
Several vulnerabilities have been discovered in Linux Kernel

oval:org.secpod.oval:def:1501676
Several vulnerabilities have been discovered in Linux Kernel and dtrace-modules

oval:org.secpod.oval:def:1501679
Several vulnerabilities have been discovered in Linux Kernel

oval:org.secpod.oval:def:1501678
Several vulnerabilities have been discovered in Linux Kernel and dtrace-modules

oval:org.secpod.oval:def:1501680
Several vulnerabilities have been discovered in Linux Kernel and dtrace-modules

oval:org.secpod.oval:def:1501681
Several vulnerabilities have been discovered in Linux Kernel and dtrace-modules

oval:org.secpod.oval:def:34940
The host is installed with RHEL 7 and is prone to a null pointer dereference vulnerability. A flaw is present in the application, which fails to handle a malformed input document. Successful exploitation could allow attackers to execute arbitrary code or crash the service.

oval:org.secpod.oval:def:34930
libgd2: GD Graphics Library The GD library could be made to crash or run programs if it processed a specially crafted image file.

oval:org.secpod.oval:def:34931
libgd2: GD Graphics Library The GD library could be made to crash or run programs if it processed a specially crafted image file.

oval:org.secpod.oval:def:703202
linux-raspi2: Linux kernel for Raspberry Pi 2 The system could be made to crash under certain conditions.

oval:org.secpod.oval:def:703205
linux-lts-utopic: Linux hardware enablement kernel from Utopic for Trusty The system could be made to crash under certain conditions.

oval:org.secpod.oval:def:703203
linux-lts-vivid: Linux hardware enablement kernel from Vivid for Trusty The system could be made to crash under certain conditions.

oval:org.secpod.oval:def:703209
linux-lts-trusty: Linux hardware enablement kernel from Trusty for Precise The system could be made to crash under certain conditions.

oval:org.secpod.oval:def:703207
linux: Linux kernel The system could be made to crash under certain conditions.

oval:org.secpod.oval:def:111284
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:111287
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:1600439
A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer used to read the uploaded file if the boundary was the typical tens of bytes long.

oval:org.secpod.oval:def:703196
tomcat8: Servlet and JSP engine Tomcat could be made to hang if it received specially crafted network traffic.

oval:org.secpod.oval:def:703188
tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:602553
The TERASOLUNA Framework Development Team discovered a denial of service vulnerability in Apache Commons FileUpload, a package to make it easy to add robust, high-performance, file upload capability to servlets and web applications. A remote attacker can take advantage of this flaw by sending file u ...

oval:org.secpod.oval:def:204119
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. The following packages have been upgraded to a newer upstream version: tomcat . Security Fix: * A CSRF flaw was found in Tomcat"s the index pages for the Manager and Host Manager applications. These applic ...

oval:org.secpod.oval:def:602549
The TERASOLUNA Framework Development Team discovered a denial of service vulnerability in Apache Commons FileUpload, a package to make it easy to add robust, high-performance, file upload capability to servlets and web applications. A remote attacker can take advantage of this flaw by sending file u ...

oval:org.secpod.oval:def:602545
Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in information disclosure, the bypass of CSRF protections, bypass of the SecurityManager or denial of service.

oval:org.secpod.oval:def:1501655
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. The following packages have been upgraded to a newer upstream version: tomcat . Security Fix: * A CSRF flaw was found in Tomcat"s the index pages for the Manager and Host Manager applications. These applic ...

oval:org.secpod.oval:def:501905
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. The following packages have been upgraded to a newer upstream version: tomcat . Security Fix: * A CSRF flaw was found in Tomcat"s the index pages for the Manager and Host Manager applications. These applic ...

oval:org.secpod.oval:def:35821
The host is installed with Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36 or 8.5.x before 8.5.3 and is prone to a denial of service vulnerability. A flaw is present in the MultipartStream class in Apache Commons Fileupload, which fails to handle a long boundary string. Successful exploitation al ...

oval:org.secpod.oval:def:35820
tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:35819
tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:602432
Several vulnerabilities were found in SPIP, a website engine for publishing, resulting in code injection. CVE-2016-3153 g0uZ et sambecks, from team root-me, discovered that arbitrary PHP code could be injected when adding content. CVE-2016-3154 Gilles Vincent discovered that deserializing untrusted ...

oval:org.secpod.oval:def:110456
XStream is a simple library to serialize objects to XML and back again. A high level facade is supplied that simplifies common use cases. Custom objects can be serialized without need for specifying mappings. Speed and low memory footprint are a crucial part of the design, making it suitable for lar ...

oval:org.secpod.oval:def:110452
XStream is a simple library to serialize objects to XML and back again. A high level facade is supplied that simplifies common use cases. Custom objects can be serialized without need for specifying mappings. Speed and low memory footprint are a crucial part of the design, making it suitable for lar ...

oval:org.secpod.oval:def:602499
It was discovered that XStream, a Java library to serialize objects to XML and back again, was susceptible to XML External Entity attacks.

oval:org.secpod.oval:def:1501471
It was found that libndp did not properly validate and check the origin of Neighbor Discovery Protocol (NDP) messages. An attacker on a non-local network could use this flaw to advertise a node as a router, allowing them to perform man-in-the-middle attacks on a connecting client, or disrupt the net ...

oval:org.secpod.oval:def:110568
This package contains a library which provides a wrapper for IPv6 Neighbor Discovery Protocol. It also provides a tool named ndptool for sending and receiving NDP messages.

oval:org.secpod.oval:def:35693
The host is installed with RHEL 6 or 7 and is prone to a stack overflow vulnerability. A flaw is present in the application, which fails to properly handle crafted xml file. Successful exploitation could allow attackers to crash the service.

oval:org.secpod.oval:def:110575
This package contains a library which provides a wrapper for IPv6 Neighbor Discovery Protocol. It also provides a tool named ndptool for sending and receiving NDP messages.

oval:org.secpod.oval:def:203937
Libndp is a library that provides a wrapper for the IPv6 Neighbor Discovery Protocol. It also provides a tool named ndptool for sending and receiving NDP messages. Security Fix: * It was found that libndp did not properly validate and check the origin of Neighbor Discovery Protocol messages. An at ...

oval:org.secpod.oval:def:501828
Libndp is a library that provides a wrapper for the IPv6 Neighbor Discovery Protocol. It also provides a tool named ndptool for sending and receiving NDP messages. Security Fix: * It was found that libndp did not properly validate and check the origin of Neighbor Discovery Protocol messages. An at ...

oval:org.secpod.oval:def:602505
Julien Bernard discovered that libndp, a library for the IPv6 Neighbor Discovery Protocol, does not properly perform input and origin checks during the reception of a NDP message. An attacker in a non-local network could use this flaw to advertise a node as a router, and cause a denial of service at ...

oval:org.secpod.oval:def:703125
libndp: Library for Neighbor Discovery Protocol libndp could be tricked into accepting an NDP message from outside the local network.

oval:org.secpod.oval:def:35568
The host is installed with RHEL 7 and is prone to an out of bounds read vulnerability. A flaw is present in the application, which incorrectly relies on write system call. Successful exploitation could allow attackers to crash the service.

oval:org.secpod.oval:def:204098
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm packages provide the user-space component for running virtual machines using KVM. Security Fix: * An out-of-bounds read/write access flaw was found in the way QEMU"s VGA emulation with VESA BIOS Extensions ...

oval:org.secpod.oval:def:1501453
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm packages provide the user-space component for running virtual machines using KVM. Security Fix: * An out-of-bounds read/write access flaw was found in the way QEMU"s VGA emulation with VESA BIOS Extensions su ...

oval:org.secpod.oval:def:110577
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:110542
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor

oval:org.secpod.oval:def:34322
qemu: Machine emulator and virtualizer - qemu-kvm: Machine emulator and virtualizer. Incorrect banked access bounds checking in vga module.

oval:org.secpod.oval:def:203931
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm packages provide the user-space component for running virtual machines using KVM. Security Fix: * An out-of-bounds read/write access flaw was found in the way QEMU"s VGA emulation with VESA BIOS Extensions ...

oval:org.secpod.oval:def:501815
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm packages provide the user-space component for running virtual machines using KVM. Security Fix: * An out-of-bounds read/write access flaw was found in the way QEMU"s VGA emulation with VESA BIOS Extensions ...

oval:org.secpod.oval:def:501821
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm packages provide the user-space component for running virtual machines using KVM. Security Fix: * An out-of-bounds read/write access flaw was found in the way QEMU"s VGA emulation with VESA BIOS Extensions ...

oval:org.secpod.oval:def:602497
Several vulnerabilities were discovered in qemu, a fast processor emulator. CVE-2016-3710 Wei Xiao and Qinghao Tang of 360.cn Inc discovered an out-of-bounds read and write flaw in the QEMU VGA module. A privileged guest user could use this flaw to execute arbitrary code on the host with the privile ...

oval:org.secpod.oval:def:1501807
Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix: * An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU ...

oval:org.secpod.oval:def:502000
Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix: * An integer overflow flaw and an out-of-bounds read flaw were found in the way QEM ...

oval:org.secpod.oval:def:1501543
The libtiff packages contain a library of functions for manipulating Tagged Image File Format files. Security Fix: * Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an ...

oval:org.secpod.oval:def:1600435
Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an application linked against libtiff into processing specially crafted files. Multiple flaws have been discovered in va ...

oval:org.secpod.oval:def:203982
The libtiff packages contain a library of functions for manipulating Tagged Image File Format files. Security Fix: * Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an ...

oval:org.secpod.oval:def:203978
The libtiff packages contain a library of functions for manipulating Tagged Image File Format files. Security Fix: * Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an ...

oval:org.secpod.oval:def:501854
The libtiff packages contain a library of functions for manipulating Tagged Image File Format files. Security Fix: * Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an ...

oval:org.secpod.oval:def:501858
The libtiff packages contain a library of functions for manipulating Tagged Image File Format files. Security Fix: * Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an ...

oval:org.secpod.oval:def:703055
optipng: advanced PNG optimizer OptiPNG could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:1600440
Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an application linked against libtiff into processing specially crafted files

oval:org.secpod.oval:def:110400
Imlib 2 is a library that does image file loading and saving as well as rendering, manipulation, arbitrary polygon support, etc. It does ALL of these operations FAST. Imlib2 also tries to be highly intelligent about doing them, so writing naive programs can be done easily, without sacrificing speed. ...

oval:org.secpod.oval:def:34611
qemu: Machine emulator and virtualizer - qemu-kvm: Machine emulator and virtualizer Several security issues were fixed in QEMU.

oval:org.secpod.oval:def:110561
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system , including a processor and various peripherials. It can be used to launch differe ...

oval:org.secpod.oval:def:110505
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system , including a processor and various peripherials. It can be used to launch differe ...

oval:org.secpod.oval:def:602953
Alvaro Munoz and Christian Schneider discovered that jython, an implementation of the Python language seamlessly integrated with Java, is prone to arbitrary code execution triggered when sending a serialized function to the deserializer.

oval:org.secpod.oval:def:703107
qemu: Machine emulator and virtualizer - qemu-kvm: Machine emulator and virtualizer Several security issues were fixed in QEMU.

oval:org.secpod.oval:def:110560
Imlib 2 is a library that does image file loading and saving as well as rendering, manipulation, arbitrary polygon support, etc. It does ALL of these operations FAST. Imlib2 also tries to be highly intelligent about doing them, so writing naive programs can be done easily, without sacrificing speed. ...

oval:org.secpod.oval:def:110557
Imlib 2 is a library that does image file loading and saving as well as rendering, manipulation, arbitrary polygon support, etc. It does ALL of these operations FAST. Imlib2 also tries to be highly intelligent about doing them, so writing naive programs can be done easily, without sacrificing speed. ...

oval:org.secpod.oval:def:36988
imlib2: Image manipulation and rendering library Several security issues were fixed in Imlib2.

oval:org.secpod.oval:def:602480
Several vulnerabilities were discovered in imlib2, an image manipulation library. CVE-2011-5326 Kevin Ryde discovered that attempting to draw a 2x1 radi ellipse results in a floating point exception. CVE-2014-9771 It was discovered that an integer overflow could lead to invalid memory reads and unre ...

oval:org.secpod.oval:def:703258
imlib2: Image manipulation and rendering library Several security issues were fixed in Imlib2.

oval:org.secpod.oval:def:1501803
The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based protocols. Quagga supports the BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is intended to be used as a Route Server and Route Reflector. Security Fix: * A stack-based buffer ...

oval:org.secpod.oval:def:111576
Quagga is free software that operates TCP/IP-based routing protocols. It takes a multi-server and multi-threaded approach to resolving the current complexity of the Internet. Quagga supports Babel, BGP4, BGP4+, BGP4-, IS-IS , OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng. Quagga is intended to be used as ...

oval:org.secpod.oval:def:111570
Quagga is free software that operates TCP/IP-based routing protocols. It takes a multi-server and multi-threaded approach to resolving the current complexity of the Internet. Quagga supports Babel, BGP4, BGP4+, BGP4-, IS-IS , OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng. Quagga is intended to be used as ...

oval:org.secpod.oval:def:501999
The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based protocols. Quagga supports the BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is intended to be used as a Route Server and Route Reflector. Security Fix: * A stack-based buffer ...

oval:org.secpod.oval:def:602507
Multiple vulnerabilities were discovered in the dissectors/parsers for PKTC, IAX2, GSM CBCH and NCP which could result in denial of service.

oval:org.secpod.oval:def:34139
The host is installed with Wireshark 1.12.x before 1.12.11 or 2.0.x before 2.0.3 and is prone to a denial of service vulnerability. A flaw is present in the PKTC dissector, which fails to verify BER identifiers. Successful exploitation allows remote attackers to cause a denial of service (out-of-bou ...

oval:org.secpod.oval:def:34128
The host is installed with Wireshark 1.12.x before 1.12.11 or 2.0.x before 2.0.3 and is prone to a denial of service vulnerability. A flaw is present in the PKTC dissector, which fails to verify BER identifiers. Successful exploitation allows remote attackers to cause a denial of service (out-of-bou ...

oval:org.secpod.oval:def:34145
The host is installed with Wireshark 1.12.x before 1.12.11 and is prone to a stack-based buffer overflow vulnerability. A flaw is present in the NCP dissector, which fails to handle a long string in a packet. Successful exploitation could allow remote attackers to cause a denial of service (applicat ...

oval:org.secpod.oval:def:34142
The host is installed with Wireshark 1.12.x before 1.12.11 or 2.0.x before 2.0.3 and is prone to a denial of service vulnerability. A flaw is present in the GSM CBCH dissector, which uses the wrong variable to index an array. Successful exploitation allows remote attackers to cause a denial of servi ...

oval:org.secpod.oval:def:34134
The host is installed with Wireshark 1.12.x before 1.12.11 and is prone to a stack-based buffer overflow vulnerability. A flaw is present in the NCP dissector, which fails to handle a long string in a packet. Successful exploitation could allow remote attackers to cause a denial of service (applicat ...

oval:org.secpod.oval:def:34131
The host is installed with Wireshark 1.12.x before 1.12.11 or 2.0.x before 2.0.3 and is prone to a denial of service vulnerability. A flaw is present in the GSM CBCH dissector, which uses the wrong variable to index an array. Successful exploitation allows remote attackers to cause a denial of servi ...

oval:org.secpod.oval:def:1501568
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. ...

oval:org.secpod.oval:def:1600453
A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive"s file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. Multiple out-of-bounds write ...

oval:org.secpod.oval:def:204001
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. ...

oval:org.secpod.oval:def:400781
libarchive was updated to fix 20 security issues. These security issues were fixed: - CVE-2015-8918: Overlapping memcpy in CAB parser . - CVE-2015-8919: Heap out of bounds read in LHA/LZH parser . - CVE-2015-8920: Stack out of bounds read in ar parser . - CVE-2015-8921: Global out of bounds read in ...

oval:org.secpod.oval:def:501872
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. ...

oval:org.secpod.oval:def:602602
Hanno Boeck and Marcin Noga discovered multiple vulnerabilities in libarchive; processing malformed archives may result in denial of service or the execution of arbitrary code.

oval:org.secpod.oval:def:703208
libarchive: Library to read/write archive files libarchive could be made to crash or run programs if it opened a specially crafted file.

oval:org.secpod.oval:def:35967
The host is installed with LibreOffice before 5.1.4.2 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a crafted RTF file, related to stylesheet and supercript tokens. Successful exploitation could allow remote attackers to execute arbitrar ...

oval:org.secpod.oval:def:110838
LibreOffice is an Open Source, community-developed, office productivity suite. It includes the key desktop applications, such as a word processor, spreadsheet, presentation manager, formula editor and drawing program, with a user interface and feature set similar to other office suites. Sophisticate ...

oval:org.secpod.oval:def:36103
The host is installed with LibreOffice before 5.1.4002 and is prone to an use-after-free vulnerability. A flaw is present in the application, which fails to handle a crafted RTF file, related to stylesheet and supercript tokens. Successful exploitation could allow remote attackers to execute arbitra ...

oval:org.secpod.oval:def:703183
libreoffice: Office productivity suite LibreOffice could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:602558
Yves Younan of Cisco Talos discovered several vulnerabilities in the MXit protocol support in pidgin, a multi-protocol instant messaging client. A remote attacker can take advantage of these flaws to cause a denial of service , overwrite files, information disclosure, or potentially to execute arbit ...

oval:org.secpod.oval:def:602547
Aleksandar Nikolic discovered that missing input sanitising in the RTF parser in Libreoffice may result in the execution of arbitrary code if a malformed documented is opened.

oval:org.secpod.oval:def:40396
The host is installed with Pidgin before 2.11.0 and is prone to a directory traversal vulnerability. A flaw is present in the application, which fails to properly handle a crafted MXIT data. Successful exploitation allows attackers to provide an invalid filename for a splash image.

oval:org.secpod.oval:def:703204
pidgin: graphical multi-protocol instant messaging client for X Pidgin could be made to crash or run programs if it received specially crafted network traffic.

oval:org.secpod.oval:def:602508
Gustavo Grieco discovered several flaws in the way librsvg, a SAX-based renderer library for SVG files, parses SVG files with circular definitions. A remote attacker can take advantage of these flaws to cause an application using the librsvg library to crash.

oval:org.secpod.oval:def:703852
horizon: Web interface for OpenStack cloud infrastructure OpenStack Horizon could be made to expose sensitive information over the network.

oval:org.secpod.oval:def:110799
Horizon is a Django application for providing Openstack UI components. It allows performing site administrator and end user operations

oval:org.secpod.oval:def:35562
The host is installed with RHEL 6 or 7 and is prone to a heap-based buffer underreads vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow attackers to execute arbitrary code.

oval:org.secpod.oval:def:34288
The host is installed with Apple iTunes before 12.4.2 and is prone to a memory corruption vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation allows attackers to crash the service.

oval:org.secpod.oval:def:1600416
A problem was identified in nginx code responsible for saving client request body to a temporary file. A specially crafted request might result in worker process crash due to a NULL pointer dereference while writing client request body to a temporary file.

oval:org.secpod.oval:def:34291
The host is installed with Apple iTunes before 12.4.2 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to handle crafted XML document. Successful exploitation allows attackers to disclose user information.

oval:org.secpod.oval:def:602523
It was discovered that a NULL pointer dereference in the Nginx code responsible for saving client request bodies to a temporary file might result in denial of service: Malformed requests could crash worker processes.

oval:org.secpod.oval:def:703145
nginx: small, powerful, scalable web/proxy server nginx could be made to crash if it received specially crafted network traffic.

oval:org.secpod.oval:def:110606
Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage.

oval:org.secpod.oval:def:602548
Brandon Perry discovered that xerces-c, a validating XML parser library for C++, fails to successfully parse a DTD that is deeply nested, causing a stack overflow. A remote unauthenticated attacker can take advantage of this flaw to cause a denial of service against applications using the xerces-c l ...

oval:org.secpod.oval:def:34290
The host is installed with Apple iTunes before 12.4.2 and is prone to a memory corruption vulnerability. A flaw is present in the application, which fails to handle crafted data. Successful exploitation allows attackers to crash the service.

oval:org.secpod.oval:def:602509
It was discovered that a buffer overflow in the XMLRPC response encoding code of the Atheme IRC services may result in denial of service.

oval:org.secpod.oval:def:602494
Simon McVittie discovered a cross-site scripting vulnerability in the error reporting of Ikiwiki, a wiki compiler. This update also hardens ikiwiki"s use of imagemagick in the img plugin.

oval:org.secpod.oval:def:110884
MinGW Windows openjpeg2 library.

oval:org.secpod.oval:def:110873
The OpenJPEG library is an open-source JPEG 2000 library developed in order to promote the use of JPEG 2000. This package contains * JPEG 2000 codec compliant with the Part 1 of the standard . * JP2

oval:org.secpod.oval:def:110879
MinGW Windows openjpeg2 library.

oval:org.secpod.oval:def:110857
The OpenJPEG library is an open-source JPEG 2000 library developed in order to promote the use of JPEG 2000. This package contains * JPEG 2000 codec compliant with the Part 1 of the standard . * JP2

oval:org.secpod.oval:def:110982
Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux . The main package includes the libvirtd server exporting the virtualization support.

oval:org.secpod.oval:def:204129
The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. The following packages have been upgraded to a newer upstream version: libvir ...

oval:org.secpod.oval:def:602554
Vivian Zhang and Christoph Anton Mitterer discovered that setting an empty VNC password does not work as documented in Libvirt, a virtualisation abstraction library. When the password on a VNC server is set to the empty string, authentication on the VNC server will be disabled, allowing any user to ...

oval:org.secpod.oval:def:1501628
The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. The following packages have been upgraded to a newer upstream version: libvir ...

oval:org.secpod.oval:def:111126
Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux . The main package includes the libvirtd server exporting the virtualization support.

oval:org.secpod.oval:def:501918
The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. The following packages have been upgraded to a newer upstream version: libvir ...

oval:org.secpod.oval:def:35695
The host is installed with VideoLAN vlc media player before 2.2.4 and is prone to a buffer overflow vulnerability. A flaw is present in the application, which fails to handle a QuickTime IMA file. Successful exploitation could allow remote attackers to cause a denial of service (crash) or possibly e ...

oval:org.secpod.oval:def:36105
libgd2: GD Graphics Library The GD library could be made to crash or run programs if it processed a specially crafted image file.

oval:org.secpod.oval:def:602530
Patrick Coleman discovered that missing input sanitising in the ADPCM decoder of the VLC media player may result in the execution of arbitrary code if a malformed media file is opened.

oval:org.secpod.oval:def:110599
The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the fo ...

oval:org.secpod.oval:def:602557
Several vulnerabilities were discovered in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using the libgd2 library , or potentially to execute arbitrary code with the privi ...

oval:org.secpod.oval:def:110628
The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the fo ...

oval:org.secpod.oval:def:703200
libgd2: GD Graphics Library The GD library could be made to crash or run programs if it processed a specially crafted image file.

oval:org.secpod.oval:def:34971
The host is installed with VideoLAN vlc media player before 2.2.4 and is prone to a buffer overflow vulnerability. A flaw is present in the application, which fails to handle a crafted QuickTime IMA file. Successful exploitation could allow remote attackers to cause a denial of service (crash) or po ...

oval:org.secpod.oval:def:400720
This update for ImageMagick fixes the following issues: This security issue was fixed: - CVE-2016-5118: Prevent code execution via popen This non-security issue was fixed: - Fix encoding of /Title in generated PDFs

oval:org.secpod.oval:def:602521
Bob Friesenhahn from the GraphicsMagick project discovered a command injection vulnerability in ImageMagick, a program suite for image manipulation. An attacker with control on input image or the input filename can execute arbitrary commands with the privileges of the user running the application. T ...

oval:org.secpod.oval:def:703146
imagemagick: Image manipulation programs and library Several security issues were fixed in ImageMagick.

oval:org.secpod.oval:def:111429
Chromium is an open-source web browser, powered by WebKit .

oval:org.secpod.oval:def:204466
OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix: * Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potent ...

oval:org.secpod.oval:def:204468
OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix: * Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potent ...

oval:org.secpod.oval:def:1501798
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:1501801
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:1600517
Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potentially, execute arbitrary code. A vulnerability was found in the patch for CVE-2013-6045 for OpenJPEG. A spe ...

oval:org.secpod.oval:def:501992
OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix: * Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potent ...

oval:org.secpod.oval:def:502008
OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix: * Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potent ...

oval:org.secpod.oval:def:37429
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:37428
The host is installed with Google Chrome before 53.0.2785.143 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:37427
The host is installed with Google Chrome before 53.0.2785.143 and is prone to an use after free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:37425
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:37424
The host is missing a security update according to Google advisory. The update is required to fix multiple vulnerabilities. The flaws are present in the application, which fails to handle crafted data. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:37423
The host is installed with Google Chrome before 53.0.2785.143 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:37422
The host is installed with Google Chrome before 53.0.2785.143 and is prone to multiple vulnerabilities. The flaws are present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:37421
The host is installed with Google Chrome before 53.0.2785.143 and is prone to an use after free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:37420
The host is installed with Google Chrome before 53.0.2785.143 and is prone to an use after free vulnerability. A flaw is present in the application, which fails to handle unspecified vectors. Successful exploitation allows attackers to have unspecified impact.

oval:org.secpod.oval:def:111452
Chromium is an open-source web browser, powered by WebKit .

oval:org.secpod.oval:def:602632
Several vulnerabilities have been discovered in the chromium web browser. CVE-2016-5177 A use-after-free issue was discovered in the v8 javascript library. CVE-2016-5178 The chrome development team found and fixed various issues during internal auditing.

oval:org.secpod.oval:def:703299
oxide-qt: Web browser engine for Qt Several security issues were fixed in Oxide.

oval:org.secpod.oval:def:703383
c-ares: library for asynchronous name resolves c-ares could be made to crash or run programs if it processed a specially crafted hostname.

oval:org.secpod.oval:def:111413
c-ares is a C library that performs DNS requests and name resolves asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT.

oval:org.secpod.oval:def:111401
c-ares is a C library that performs DNS requests and name resolves asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT.

oval:org.secpod.oval:def:111404
c-ares is a C library that performs DNS requests and name resolves asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT.

oval:org.secpod.oval:def:111425
c-ares is a C library that performs DNS requests and name resolves asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT.

oval:org.secpod.oval:def:111522
Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

oval:org.secpod.oval:def:602633
Gzob Qq discovered that the query-building functions in c-ares, an asynchronous DNS request library would not correctly process crafted query names, resulting in a heap buffer overflow and potentially leading to arbitrary code execution.

oval:org.secpod.oval:def:703320
linux: Linux kernel The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:703325
linux-raspi2: Linux kernel for Raspberry Pi 2 The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:703316
linux-snapdragon: Linux kernel for Snapdragon Processors The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:703315
linux: Linux kernel The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:703319
linux-lts-trusty: Linux hardware enablement kernel from Trusty for Precise The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:703318
linux-raspi2: Linux kernel for Raspberry Pi 2 The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:703317
linux-ti-omap4: Linux kernel for OMAP4 The system could be made to run programs as an administrator.

oval:org.secpod.oval:def:1600463
CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakageA race condition was found in the way the Linux kernel"s memory subsystem handled the copy-on-write breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherw ...

oval:org.secpod.oval:def:204030
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * A race condition was found in the way the Linux kernel"s memory subsystem handled the copy-on-write breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to ...

oval:org.secpod.oval:def:204029
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * A race condition was found in the way the Linux kernel"s memory subsystem handled the copy-on-write breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to ...

oval:org.secpod.oval:def:37804
The host installed with kernel package on CentOS 5, 6 or 7 and is prone to a privilege escalation vulnerability. A flaw is present in the application, which fails to properly handle the copy-on-write (COW) breakage of private read-only memory mappings. Successful exploitation could allow attackers t ...

oval:org.secpod.oval:def:37803
The host installed with kernel package on RHEL 5, 6 or 7 and is prone to a privilege escalation vulnerability. A flaw is present in the application, which fails to properly handle the copy-on-write (COW) breakage of private read-only memory mappings. Successful exploitation could allow attackers to ...

oval:org.secpod.oval:def:111472
The kernel meta package

oval:org.secpod.oval:def:111470
The kernel meta package

oval:org.secpod.oval:def:501886
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * A race condition was found in the way the Linux kernel"s memory subsystem handled the copy-on-write breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to ...

oval:org.secpod.oval:def:501887
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * A race condition was found in the way the Linux kernel"s memory subsystem handled the copy-on-write breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to ...

oval:org.secpod.oval:def:1501609
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on th ...

oval:org.secpod.oval:def:1501614
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on th ...

oval:org.secpod.oval:def:1501611
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on th ...

oval:org.secpod.oval:def:1501612
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on th ...

oval:org.secpod.oval:def:1501617
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on t ...

oval:org.secpod.oval:def:1501616
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on t ...

oval:org.secpod.oval:def:602648
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2015-8956 It was discovered that missing input sanitising in RFCOMM Bluetooth socket handling may result in denial of service or information leak. CVE ...

oval:org.secpod.oval:def:1600420
It was discovered that GraphicsMagick did not properly sanitize certain input before using it to invoke processes. A remote attacker could create a specially crafted image that, when processed by an application using GraphicsMagick or an unsuspecting user using the GraphicsMagick utilities, would le ...

oval:org.secpod.oval:def:1600419
It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processes. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arb ...

oval:org.secpod.oval:def:1501499
ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. Security Fix: * It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processes. A remote attacker could create a specially cra ...

oval:org.secpod.oval:def:1501498
ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. Security Fix: * It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processes. A remote attacker could create a specially cra ...

oval:org.secpod.oval:def:203951
ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. Security Fix: * It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processes. A remote attacker could create a specially cra ...

oval:org.secpod.oval:def:203947
ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. Security Fix: * It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processes. A remote attacker could create a specially cra ...

oval:org.secpod.oval:def:501837
ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. Security Fix: * It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processes. A remote attacker could create a specially cra ...

oval:org.secpod.oval:def:110621
GraphicsMagick is a comprehensive image processing package which is initially based on ImageMagick 5.5.2, but which has undergone significant re-work by the GraphicsMagick Group to significantly improve the quality and performance of the software.

oval:org.secpod.oval:def:110617
GraphicsMagick is a comprehensive image processing package which is initially based on ImageMagick 5.5.2, but which has undergone significant re-work by the GraphicsMagick Group to significantly improve the quality and performance of the software.

oval:org.secpod.oval:def:39517
The host is installed with Apple iTunes before 12.6 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to properly handle crafted identifiers. Successful exploitation could allows context-dependent attackers to cause a denial of service (CPU consumpt ...

oval:org.secpod.oval:def:39506
The host is installed with Apple iTunes before 12.6 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to handle crafted identifiers in an XML document. Successful exploitation allows attackers to cause a denial of service (CPU consumption).

oval:org.secpod.oval:def:602529
Two related issues have been discovered in Expat, a C library for parsing XML. CVE-2012-6702 It was introduced when CVE-2012-0876 was addressed. Stefan Sørensen discovered that the use of the function XML_Parse seeds the random number generator generating repeated outputs for rand calls. ...

oval:org.secpod.oval:def:703167
expat: XML parsing C library Several security issues were fixed in Expat.

oval:org.secpod.oval:def:111246
Fontconfig is designed to locate fonts within the system and select them according to requirements specified by applications.

oval:org.secpod.oval:def:204150
Fontconfig is designed to locate fonts within the system and select them according to requirements specified by applications. Security Fix: * It was found that cache files were insufficiently validated in fontconfig. A local attacker could create a specially crafted cache file to trigger arbitrary f ...

oval:org.secpod.oval:def:501890
Fontconfig is designed to locate fonts within the system and select them according to requirements specified by applications. Security Fix: * It was found that cache files were insufficiently validated in fontconfig. A local attacker could create a specially crafted cache file to trigger arbitrary f ...

oval:org.secpod.oval:def:1501637
Fontconfig is designed to locate fonts within the system and select them according to requirements specified by applications. Security Fix: * It was found that cache files were insufficiently validated in fontconfig. A local attacker could create a specially crafted cache file to trigger arbitrary f ...

oval:org.secpod.oval:def:111187
Fontconfig is designed to locate fonts within the system and select them according to requirements specified by applications.

oval:org.secpod.oval:def:703241
fontconfig: generic font configuration library Fontconfig be made to crash or run programs if it opened a specially crafted file.

oval:org.secpod.oval:def:602586
Tobias Stoeckmann discovered that cache files are insufficiently validated in fontconfig, a generic font configuration library. An attacker can trigger arbitrary free calls, which in turn allows double free attacks and therefore arbitrary code execution. In combination with setuid binaries using cra ...

oval:org.secpod.oval:def:1501582
CVE-2016-5403 : The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion. CVE-2016-3710 : The VGA module in QEMU improperly performs bou ...

oval:org.secpod.oval:def:204011
KVM is a full virtualization solution for Linux on x86 hardware. Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, etc. Security Fix: * An out-of-bounds read/wri ...

oval:org.secpod.oval:def:204128
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix: * A flaw was found in the way certain error conditions were handled by bzread function in PHP. An attacker could use this flaw to upload a specially crafted bz2 archive which, when parsed via the vuln ...

oval:org.secpod.oval:def:501893
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix: * A flaw was found in the way certain error conditions were handled by bzread function in PHP. An attacker could use this flaw to upload a specially crafted bz2 archive which, when parsed via the vuln ...

oval:org.secpod.oval:def:400618
This update for xen to version 4.5.3 fixes the several issues. These security issues were fixed: - CVE-2016-6258: Potential privilege escalation in PV guests . - CVE-2016-6259: Missing SMAP whitelisting in 32-bit exception / event delivery . - CVE-2016-5337: The megasas_ctrl_get_info function allo ...

oval:org.secpod.oval:def:1501634
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix: * A flaw was found in the way certain error conditions were handled by bzread function in PHP. An attacker could use this flaw to upload a specially crafted bz2 archive which, when parsed via the vuln ...

oval:org.secpod.oval:def:111244
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+passwo ...

oval:org.secpod.oval:def:1501571
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. ...

oval:org.secpod.oval:def:1600434
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session. curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to re ...

oval:org.secpod.oval:def:1600454
After testing original CVE-2016-5420 patch, it was discovered that libcurl built on top of NSS still incorrectly re-uses client certificates if a certificate from file is used for one TLS connection but no certificate is set for a subsequent TLS connection.

oval:org.secpod.oval:def:204000
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. ...

oval:org.secpod.oval:def:204134
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix: * It was found that the libcurl library did not prevent TLS session resumption when the client certificate had changed. An attac ...

oval:org.secpod.oval:def:501871
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. ...

oval:org.secpod.oval:def:1501656
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix: * It was found that the libcurl library did not prevent TLS session resumption when the client certificate had changed. An attac ...

oval:org.secpod.oval:def:111171
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+passwo ...

oval:org.secpod.oval:def:501913
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix: * It was found that the libcurl library did not prevent TLS session resumption when the client certificate had changed. An attac ...

oval:org.secpod.oval:def:602578
Several vulnerabilities were discovered in cURL, an URL transfer library: CVE-2016-5419 Bru Rom discovered that libcurl would attempt to resume a TLS session even if the client certificate had changed. CVE-2016-5420 It was discovered that libcurl did not consider client certificates when reusing TLS ...

oval:org.secpod.oval:def:36755
curl: HTTP, HTTPS, and FTP client and client libraries Several security issues were fixed in curl.

oval:org.secpod.oval:def:703223
curl: HTTP, HTTPS, and FTP client and client libraries Several security issues were fixed in curl.

oval:org.secpod.oval:def:38564
The host is installed with PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, or 9.5.x before 9.5.4 and is prone to a privilege escalation vulnerability. A flaw is present in the application, which fails to handle a (1) " (double quote), (2) \ (backslash), (3) ca ...

oval:org.secpod.oval:def:38565
The host is installed with PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, or 9.5.x before 9.5.4 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails to handle a CASE expression or inlining of an SQL function. Su ...

oval:org.secpod.oval:def:111243
PostgreSQL is an advanced Object-Relational database management system . The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as t ...

oval:org.secpod.oval:def:111237
PostgreSQL is an advanced Object-Relational database management system . The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as t ...

oval:org.secpod.oval:def:1600448
A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code. A flaw wa ...

oval:org.secpod.oval:def:204023
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application de ...

oval:org.secpod.oval:def:204153
PostgreSQL is an advanced object-relational database management system . The following packages have been upgraded to a newer upstream version: postgresql . Security Fix: * A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authentic ...

oval:org.secpod.oval:def:501880
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application de ...

oval:org.secpod.oval:def:1501630
PostgreSQL is an advanced object-relational database management system . The following packages have been upgraded to a newer upstream version: postgresql . Security Fix: * A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authentic ...

oval:org.secpod.oval:def:501924
PostgreSQL is an advanced object-relational database management system . The following packages have been upgraded to a newer upstream version: postgresql . Security Fix: * A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authentic ...

oval:org.secpod.oval:def:602588
Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. CVE-2016-5423 Karthikeyan Jambu Rajaraman discovered that nested CASE-WHEN expressions are not properly evaluated, potentially leading to a crash or allowing to disclose portions of server memory. CVE-2016-5424 Nathan ...

oval:org.secpod.oval:def:703239
postgresql-9.5: object-relational SQL database - postgresql-9.3: Object-relational SQL database - postgresql-9.1: Object-relational SQL database Several security issues were fixed in PostgreSQL.

oval:org.secpod.oval:def:204141
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Security Fix: * It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy function in certain cases. An untrusted Jav ...

oval:org.secpod.oval:def:703328
mysql-5.7: MySQL database - mysql-5.5: MySQL database Several security issues were fixed in MySQL.

oval:org.secpod.oval:def:602662
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.53, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes

oval:org.secpod.oval:def:602667
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.28. Please see the MariaDB 10.0 Release Notes for further details: https://mariadb.com/kb/en/mariadb/mariadb-10028-release-notes/

oval:org.secpod.oval:def:602743
Multiple vulnerabilities have been discovered in the libtiff library and the included tools tiff2rgba, rgb2ycbcr, tiffcp, tiffcrop, tiff2pdf and tiffsplit, which may result in denial of service, memory disclosure or the execution of arbitrary code. There were additional vulnerabilities in the tools ...

oval:org.secpod.oval:def:703489
tiff: Tag Image File Format library LibTIFF could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:110886
The kernel meta package

oval:org.secpod.oval:def:110887
The kernel meta package

oval:org.secpod.oval:def:703253
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:703251
linux-ti-omap4: Linux kernel for OMAP4 Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:703250
linux-snapdragon: Linux kernel for Snapdragon Processors Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:703256
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:703255
linux-raspi2: Linux kernel for Raspberry Pi 2 Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:703254
linux-lts-trusty: Linux hardware enablement kernel from Trusty for Precise Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:110832
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fai ...

oval:org.secpod.oval:def:110828
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fai ...

oval:org.secpod.oval:def:110829
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fai ...

oval:org.secpod.oval:def:1501594
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:1501595
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:1501592
A flaw was found in the Linux kernel's keyring handling code, where in key_reject_and_link() an uninitialized variable would eventually lead to arbitrary free address which could allow attacker to use a use-after-free style attack. (CVE-2016-4470, Important). A heap-based buffer overflow vulnerabili ...

oval:org.secpod.oval:def:1501593
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:1501598
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:1501596
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:1501597
linux: Linux kernel Several security issues were fixed in the kernel.

oval:org.secpod.oval:def:204020
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * A flaw was found in the Linux kernel"s keyring handling code, where in key_reject_and_link an uninitialized variable would eventually lead to arbitrary free address which could allow attacker to use ...

oval:org.secpod.oval:def:501878
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: * A flaw was found in the Linux kernel"s keyring handling code, where in key_reject_and_link an uninitialized variable would eventually lead to arbitrary free address which could allow attacker to use ...

oval:org.secpod.oval:def:602552
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2014-9904 It was discovered that the snd_compress_check_input function used in the ALSA subsystem does not properly check for an integer overflow, all ...

oval:org.secpod.oval:def:36104
libgd2: GD Graphics Library The GD library could be made to crash or run programs if it processed a specially crafted image file.

oval:org.secpod.oval:def:110885
Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most comm ...

oval:org.secpod.oval:def:110874
Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most comm ...

oval:org.secpod.oval:def:110869
Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most comm ...

oval:org.secpod.oval:def:602560
It was discovered that Django, a high-level Python web development framework, is prone to a cross-site scripting vulnerability in the admin"s add/change related popup.

oval:org.secpod.oval:def:703211
python-django: High-level Python web development framework A security issue was fixed in Django.

oval:org.secpod.oval:def:111398
The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the fo ...

oval:org.secpod.oval:def:111056
The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the fo ...

oval:org.secpod.oval:def:602569
Secunia Research at Flexera Software discovered an integer overflow vulnerability within the _gdContributionsAlloc function in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of this flaw to cause a denial-of-service against an application ...

oval:org.secpod.oval:def:703226
libgd2: GD Graphics Library The GD library could be made to crash or run programs if it processed a specially crafted image file.

oval:org.secpod.oval:def:602698
Two vulnerabilities were discovered in libupnp, a portable SDK for UPnP devices. CVE-2016-6255 Matthew Garret discovered that libupnp by default allows any user to write to the filesystem of the host running a libupnp-based server application. CVE-2016-8863 Scott Tenaglia discovered a heap buffer ov ...

oval:org.secpod.oval:def:1600444
A heap-based buffer overflow in the parse_packet function in network.c in collectd allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted network packet.

oval:org.secpod.oval:def:602575
Emilien Gaspar discovered that collectd, a statistics collection and monitoring daemon, incorrectly processed incoming network packets. This resulted in a heap overflow, allowing a remote attacker to either cause a DoS via application crash, or potentially execute arbitrary code. Additionally, secur ...

oval:org.secpod.oval:def:111299
Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version.

oval:org.secpod.oval:def:111259
GnuPG is a GNU utility for encrypting data and creating digital signatures. GnuPG has advanced key management capabilities and is compliant with the proposed OpenPGP Internet standard described in RFC2440. Since GnuPG doesn't use any patented algorithm, it is not compatible with any version of ...

oval:org.secpod.oval:def:111263
Simple, battle-tested conventions and helpers for building web pages.

oval:org.secpod.oval:def:111260
Simple, battle-tested conventions and helpers for building web pages.

oval:org.secpod.oval:def:111311
GnuPG is a GNU utility for encrypting data and creating digital signatures. GnuPG has advanced key management capabilities and is compliant with the proposed OpenPGP Internet standard described in RFC2440. Since GnuPG doesn't use any patented algorithm, it is not compatible with any version of ...

oval:org.secpod.oval:def:1600447
A design flaw was found in the libgcrypt PRNG . An attacker who can obtain the first 580 bytes of the PRNG output can trivially predict the following 20 bytes.

oval:org.secpod.oval:def:204035
The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fix: * A design flaw was found in the libgcrypt PRNG . An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes. Red Hat would like to thank Fel ...

oval:org.secpod.oval:def:204151
The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fix: * A design flaw was found in the libgcrypt PRNG . An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes. Red Hat would like to thank Fel ...

oval:org.secpod.oval:def:1501649
A design flaw was found in the libgcrypt PRNG (Pseudo-Random Number Generator). An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes.

oval:org.secpod.oval:def:1501644
A design flaw was found in the libgcrypt PRNG (Pseudo-Random Number Generator). An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes.

oval:org.secpod.oval:def:501931
The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fix: * A design flaw was found in the libgcrypt PRNG . An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes. Red Hat would like to thank Fel ...

oval:org.secpod.oval:def:602597
Andrew Carpenter of Critical Juncture discovered a cross-site scripting vulnerability affecting Action View in rails, a web application framework written in Ruby. Text declared as "HTML safe" will not have quotes escaped when used as attribute values in tag helpers.

oval:org.secpod.oval:def:602593
Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of GnuPG"s random number generator. An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. A first analysis on the impact of this bug for ...

oval:org.secpod.oval:def:602592
Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of Libgcrypt"s random number generator. An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. A first analysis on the impact of this bug ...

oval:org.secpod.oval:def:703240
libgcrypt20: LGPL Crypto library - libgcrypt11: LGPL Crypto library Libgcrypt incorrectly generated random numbers.

oval:org.secpod.oval:def:703238
gnupg: GNU privacy guard - a free PGP replacement GnuPG incorrectly generated random numbers.

oval:org.secpod.oval:def:111730
The flex program generates scanners. Scanners are programs which can recognize lexical patterns in text. Flex takes pairs of regular expressions and C code as input and generates a C source file as output. The output file is compiled and linked with a library to produce an executable. The executable ...

oval:org.secpod.oval:def:37385
gdk-pixbuf: GDK-Pixbuf library GDK-PixBuf could be made to crash or run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:111176
The flex program generates scanners. Scanners are programs which can recognize lexical patterns in text. Flex takes pairs of regular expressions and C code as input and generates a C source file as output. The output file is compiled and linked with a library to produce an executable. The executable ...

oval:org.secpod.oval:def:602606
It was reported that the update for flex as released in DSA-3653-1 did not completely address CVE-2016-6354 as intended due to problems in the patch handling and regenerated files during the build. Additionally a regression was introduced, causing new warnings when compiling flex generated code. Upd ...

oval:org.secpod.oval:def:602596
Alexander Sulfrian discovered a buffer overflow in the yy_get_next_buffer function generated by Flex, which may result in denial of service and potentially the execution of code if operating on data from untrusted sources. Affected applications need to be rebuild. bogofilter will be rebuild against ...

oval:org.secpod.oval:def:602598
Two vulnerabilities were discovered in MuPDF, a lightweight PDF viewer. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-6265 Marco Grassi discovered a use-after-free vulnerability in MuPDF. An attacker can take advantage of this flaw to cause an applicati ...

oval:org.secpod.oval:def:602630
Lukas Reschke discovered that Apache Jackrabbit, an implementation of the Content Repository for Java Technology API, did not correctly check the Content-Type header on HTTP POST requests, enabling Cross-Site Request Forgery attacks by malicious web sites.

oval:org.secpod.oval:def:602700
Multiple security vulnerabilities were discovered in the Tomcat servlet and JSP engine, as well as in its Debian-specific maintainer scripts. Those flaws allowed for privilege escalation, information disclosure, and remote code execution. As part of this update, several regressions stemming from inc ...

oval:org.secpod.oval:def:602701
Multiple security vulnerabilities were discovered in the Tomcat servlet and JSP engine, as well as in its Debian-specific maintainer scripts. Those flaws allowed for privilege escalation, information disclosure, and remote code execution. As part of this update, several regressions stemming from inc ...

oval:org.secpod.oval:def:703451
tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Details: USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a regression in environments where Tomcat is started with a security manager. This update fixes the problem. We apologize for the inconvenience. Original advis ...

oval:org.secpod.oval:def:703436
tomcat8: Servlet and JSP engine - tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:38802
tomcat8: Servlet and JSP engine - tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:113178
RipRight is a minimal CD ripper modeled on autorip. It can run as a daemon and will automatically start ripping any CD found in the drive after which the disc will be ejected. Ripping is always to FLAC lossless audio format with tags taken from the community-maintained MusicBrainz lookup service and ...

oval:org.secpod.oval:def:113174
Inkscape is a vector graphics editor, with capabilities similar to Illustrator, CorelDraw, or Xara X, using the W3C standard Scalable Vector Graphics file format. It is therefore a very useful tool for web designers and as an interchange format for desktop publishing. Inkscape supports many advance ...

oval:org.secpod.oval:def:113176
Gtatool is a command line tool to manipulate GTAs. It provides a set of commands that manipulate GTAs on various levels: array element components, array dimensions, whole arrays, and streams of arrays. For example, you can add components to array elements, merge separate arrays into combined arrays ...

oval:org.secpod.oval:def:113171
Perl module to aide in locating a sub-image within an image.

oval:org.secpod.oval:def:113187
ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed work i ...

oval:org.secpod.oval:def:113188
Emacs is a powerful, customizable, self-documenting, modeless text editor. Emacs contains special code editing features, a scripting language , and the capability to read mail, news, and more without leaving the editor. This package provides an emacs binary with support for X windows.

oval:org.secpod.oval:def:113184
RMagick is an interface between Ruby and ImageMagick.

oval:org.secpod.oval:def:113237
Scraper2vdr acts as client and provides scraped metadata for tvshows and movies from epgd to other plugins via its service interface. The plugin cares about caching the images locally and also cleans up the images if not longer needed. epgd itself uses the thetvdb.com API for collecting series metad ...

oval:org.secpod.oval:def:113238
Q is a powerful and extensible functional programming language based on the term rewriting calculus. You specify an arbitrary system of equations which the interpreter uses as rewrite rules to reduce expressions to normal form. Q is useful for scientific programming and other advanced applications, ...

oval:org.secpod.oval:def:113239
pfstools is a set of command line programs for reading, writing, manipulating and viewing high-dynamic range images and video frames. All programs in the package exchange data using unix pipes and a simple generic HDR image format . The concept of the pfstools is similar to netpbm package for low-d ...

oval:org.secpod.oval:def:113236
Window Maker is an X11 window manager designed to give additional integration support to the GNUstep Desktop Environment. In every way possible, it reproduces the elegant look and feel of the NEXTSTEP GUI. It is fast, feature rich, easy to configure, and easy to use. In addition, Window Maker works ...

oval:org.secpod.oval:def:113232
Techne is a general purpose, programmable physical simulator and renderer. It reads in a set of scripts wherein every aspect of a physical system is specified and then proceeds to simulate and render the system onscreen.

oval:org.secpod.oval:def:113227
Synfig is a powerful, industrial-strength vector-based 2D animation software, designed from the ground-up for producing feature-film quality animation with fewer people and resources. It is designed to be capable of producing feature-film quality animation. It eliminates the need for tweening, preve ...

oval:org.secpod.oval:def:113222
K-3D is a complete 3D modeling, animation and rendering system. K-3D features a robust, object oriented plugin architecture, designed to scale to the needs of professional artists. It is designed from the ground up to generate motion picture quality animation using RenderMan compliant render engines ...

oval:org.secpod.oval:def:113223
AutoTrace is a program for converting bitmaps to vector graphics. Supported input formats include BMP, TGA, PNM, PPM, and any format supported by ImageMagick, whereas output can be produced in Postscript, SVG, xfig, SWF, and others.

oval:org.secpod.oval:def:113220
A port of the Really Slick Screensavers to GLX. Provides several visually impressive and graphically intensive screensavers. Note that this package contains only the display hacks themselves; you will need to install the appropriate subpackage for your desktop environment in order to use them as scr ...

oval:org.secpod.oval:def:113241
KXStitch can be used to create cross stitch patterns from scratch. It is also possible to convert existing images to a cross stitch pattern or scan one with a Sane supported scanner.

oval:org.secpod.oval:def:113243
imagick is a native php extension to create and modify images using the ImageMagick API.

oval:org.secpod.oval:def:113214
A command line tool for generating timing diagrams from ASCII input files. The input files use a structured language to represent signal state transitions and interdependencies. Raster image output support is provided by ImageMagick. It can be used for VHDL or verilog presentations.

oval:org.secpod.oval:def:113210
Synfig Animation Studio is a powerful, industrial-strength vector-based 2D animation software, designed from the ground-up for producing feature-film quality animation with fewer people and resources. It is designed to be capable of producing feature-film quality animation. It eliminates the need fo ...

oval:org.secpod.oval:def:113208
A conversion utility for the Psion files

oval:org.secpod.oval:def:113204
ImageInfo computes and displays selected image attributes. It is similar in function to the ImageMagick "identify" utility, but provides a few additional attributes , and allows command line selection of the attributes to be computed, avoiding unnecessary computation and and allowing easie ...

oval:org.secpod.oval:def:113206
VIPS is an image processing library. It is good for very large images , and for working with color. This package should be installed if you want to use a program compiled against VIPS.

oval:org.secpod.oval:def:113200
Converseen is a batch image conversion tool and resizer written in C++ with Qt5 and Magick++. Converseen allows you to convert images in more than 100 different formats!

oval:org.secpod.oval:def:113202
libdmtx is open source software for reading and writing Data Matrix 2D bar-codes on Linux, Unix, OS X, Windows, and mobile devices. At its core libdmtx is a shared library, allowing C/C++ programs to use its capabilities without restrictions or overhead. The included utility programs, dmtxread and d ...

oval:org.secpod.oval:def:602620
Gabriel Campana and Adrien Guinet from Quarkslab discovered two remotely exploitable crash and heap corruption vulnerabilities in the format parsing code in Irssi, a terminal based IRC client.

oval:org.secpod.oval:def:703281
irssi: terminal based IRC client Irssi could be made to crash if it received specially crafted network traffic.

oval:org.secpod.oval:def:602610
It was discovered that incorrect SASL authentication in the Inspircd IRC server may lead to users impersonating other users.

oval:org.secpod.oval:def:602607
It was discovered that incorrect SASL authentication in the Charybdis IRC server may lead to users impersonating other users.

oval:org.secpod.oval:def:111319
The OpenJPEG library is an open-source JPEG 2000 library developed in order to promote the use of JPEG 2000. This package contains * JPEG 2000 codec compliant with the Part 1 of the standard . * JP2

oval:org.secpod.oval:def:111334
MinGW Windows openjpeg2 library.

oval:org.secpod.oval:def:111332
MinGW Windows openjpeg2 library.

oval:org.secpod.oval:def:111326
The OpenJPEG library is an open-source JPEG 2000 library developed in order to promote the use of JPEG 2000. This package contains * JPEG 2000 codec compliant with the Part 1 of the standard . * JP2

oval:org.secpod.oval:def:36983
The host is installed with Wireshark 2.0.x before 2.0.6 and is prone to a denial of service vulnerability. A flaw is present in the Catapult DCT2000 dissector, which does not restrict the number of channels. Successful exploitation allows remote attackers to cause a denial of service (buffer over-re ...

oval:org.secpod.oval:def:36982
The host is installed with Wireshark 2.0.x before 2.0.6 and is prone to a denial of service vulnerability. A flaw is present in the H.225 dissector, which calls snprintf with one of its input buffers as the output buffer. Successful exploitation allows remote attackers to cause a denial of service ( ...

oval:org.secpod.oval:def:602619
Multiple vulnerabilities were discovered in the dissectors for H.225, Catapult DCT2000, UMTS FP and IPMI, which could result in denial of service or the execution of arbitrary code.

oval:org.secpod.oval:def:36986
The host is installed with Wireshark 2.0.x before 2.0.6 and is prone to a denial of service vulnerability. A flaw is present in the IPMI trace dissector, which does not properly consider whether a string is constant. Successful exploitation allows remote attackers to cause a denial of service (use-a ...

oval:org.secpod.oval:def:36985
The host is installed with Wireshark 2.0.x before 2.0.6 and is prone to a denial of service vulnerability. A flaw is present in the Catapult DCT2000 dissector, which fails to handle a malformed packet. Successful exploitation allows remote attackers to cause a denial of service (application crash).

oval:org.secpod.oval:def:36984
The host is installed with Wireshark 2.0.x before 2.0.6 and is prone to a denial of service vulnerability. A flaw is present in the UMTS FP dissector, which does not ensure that memory is allocated for certain data structures. Successful exploitation allows remote attackers to cause a denial of serv ...

oval:org.secpod.oval:def:111433
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle.

oval:org.secpod.oval:def:111440
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle.

oval:org.secpod.oval:def:602628
Sergey Bobrov discovered that cookie parsing in Django and Google Analytics interacted such a way that an attacker could set arbitrary cookies. This allows other malicious web sites to bypass the Cross-Site Request Forgery protections built into Django.

oval:org.secpod.oval:def:703286
python-django: High-level Python web development framework Django could be made to set arbitrary cookies.

oval:org.secpod.oval:def:602637
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.8

oval:org.secpod.oval:def:111432
Irssi is a modular IRC client with Perl scripting. Only text-mode frontend is currently supported. The GTK/GNOME frontend is no longer being maintained.

oval:org.secpod.oval:def:111430
Irssi is a modular IRC client with Perl scripting. Only text-mode frontend is currently supported. The GTK/GNOME frontend is no longer being maintained.

oval:org.secpod.oval:def:602685
Several issues have been discovered in ImageMagick, a popular set of programs and libraries for image manipulation. These issues include several problems in memory handling that can result in a denial of service attack or in execution of arbitrary code by an attacker with control on the image input.

oval:org.secpod.oval:def:703379
imagemagick: Image manipulation programs and library Several security issues were fixed in ImageMagick.

oval:org.secpod.oval:def:703307
kdepimlibs: the KDE PIM libraries KMail could be made to run HTML if it opened a specially crafted email.

oval:org.secpod.oval:def:111494
KDE PIM common libraries.

oval:org.secpod.oval:def:111492
The Akonadi Search library and indexing agent.

oval:org.secpod.oval:def:111498
Lirbrary for common kdepim apps.

oval:org.secpod.oval:def:111496
Additional plugins for KDE PIM applications.

oval:org.secpod.oval:def:111490
The Akonadi Mime Library.

oval:org.secpod.oval:def:111489
KDE PIM Runtime Environment.

oval:org.secpod.oval:def:111483
The Syndication Library.

oval:org.secpod.oval:def:111487
The KBlog library can retrieve, update or create blog posts on various popular blogging platforms like Wordpress or Blogspot.com. The KBlog Library.

oval:org.secpod.oval:def:111485
The KCalendarUtils Library.

oval:org.secpod.oval:def:111535
The KContacts Library.

oval:org.secpod.oval:def:111533
The KPimTextEdit Library.

oval:org.secpod.oval:def:111539
KDE PIM library for displaying events and calendars.

oval:org.secpod.oval:def:111537
KDE PIM library for calendar and even handling.

oval:org.secpod.oval:def:111531
The Akonadi Contacts Library.

oval:org.secpod.oval:def:111529
KDE PIM library for Grantlee template system.

oval:org.secpod.oval:def:111523
C++ wrapper and Qt integration for GpgMe library.

oval:org.secpod.oval:def:111527
PIM Storage Service.

oval:org.secpod.oval:def:111525
Mail importer library.

oval:org.secpod.oval:def:111520
The KAlarmCal Library.

oval:org.secpod.oval:def:111518
The Akonadi Notes Library.

oval:org.secpod.oval:def:111557
KDE certificate manager and unified crypto GUI.

oval:org.secpod.oval:def:111555
The KIMAP Library.

oval:org.secpod.oval:def:111559
KDE Personal Information Management suite, including: * akregator: feed aggregator * blogilo: blogging application, focused on simplicity and usability * kmail: email client * knotes: sticky notes for the desktop * kontact: integrated PIM management * korganizer: journal, appointments, events, todos

oval:org.secpod.oval:def:111553
The KMbox Library.

oval:org.secpod.oval:def:111551
The KTNef Library.

oval:org.secpod.oval:def:111545
The KCalendarCore Library.

oval:org.secpod.oval:def:111543
The Akonadi Calendar Library.

oval:org.secpod.oval:def:111549
Mail applications support library.

oval:org.secpod.oval:def:111547
The KMailTransport Library.

oval:org.secpod.oval:def:111541
Sieve support library.

oval:org.secpod.oval:def:111512
KDE Message libraries.

oval:org.secpod.oval:def:111510
The KMime Library.

oval:org.secpod.oval:def:111516
The KHolidays library provides a C++ API that determines holiday and other special events for a geographical region.

oval:org.secpod.oval:def:111514
The KLDAP Library.

oval:org.secpod.oval:def:111508
The KIdentityManagement Library.

oval:org.secpod.oval:def:111502
KDE PIM library for creating and editing calendar incidences.

oval:org.secpod.oval:def:111500
The Kontact Interface library provides API to integrate other applications with Kontact.

oval:org.secpod.oval:def:111506
KDE PIM library for rendering Gantt graphs.

oval:org.secpod.oval:def:111504
Gravatar support library.

oval:org.secpod.oval:def:111577
Personal Information Management libraries for KDE 4.

oval:org.secpod.oval:def:111560
KDE PIM cryptographic library.

oval:org.secpod.oval:def:602649
Roland Tapken discovered that insufficient input sanitising in KMail"s plain text viewer allowed the injection of HTML code.

oval:org.secpod.oval:def:111562
PIM common libraries.

oval:org.secpod.oval:def:111592
Personal Information Management libraries for KDE 4.

oval:org.secpod.oval:def:703385
ghostscript: PostScript and PDF interpreter Ghostscript could be made to crash, run programs, or disclose sensitive information if it processed a specially crafted file.

oval:org.secpod.oval:def:1600492
It was found that the ghostscript functions getenv, file name for all and .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could read environment variable, list directory and retrie ...

oval:org.secpod.oval:def:204068
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix: * It was found that the ghostscript functions getenv, filenameforall and .libfile did not h ...

oval:org.secpod.oval:def:204067
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix: * It was found that the ghostscript functions getenv, filenameforall and .libfile did not h ...

oval:org.secpod.oval:def:111458
Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures and an interpreter for Portable Document Format files. Ghostscript translates PostScript code into many common, bitmapped formats, like those understood by your printer or screen. Ghostscript is normally ...

oval:org.secpod.oval:def:111465
Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures and an interpreter for Portable Document Format files. Ghostscript translates PostScript code into many common, bitmapped formats, like those understood by your printer or screen. Ghostscript is normally ...

oval:org.secpod.oval:def:501954
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix: * It was found that the ghostscript functions getenv, filenameforall and .libfile did not h ...

oval:org.secpod.oval:def:501955
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix: * It was found that the ghostscript functions getenv, filenameforall and .libfile did not h ...

oval:org.secpod.oval:def:602643
Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may lead to the execution of arbitrary code or information disclosure if a specially crafted Postscript file is processed.

oval:org.secpod.oval:def:1501720
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix: * It was found that the ghostscript functions getenv, filenameforall and .libfile did not h ...

oval:org.secpod.oval:def:1501721
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix: * It was found that the ghostscript functions getenv, filenameforall and .libfile did not h ...

oval:org.secpod.oval:def:112130
GraphicsMagick is a comprehensive image processing package which is initially based on ImageMagick 5.5.2, but which has undergone significant re-work by the GraphicsMagick Group to significantly improve the quality and performance of the software.

oval:org.secpod.oval:def:602713
Several vulnerabilities have been discovered in GraphicsMagick, a collection of image processing tool, which can cause denial of service attacks, remote file deletion, and remote command execution. This security update removes the full support of PLT/Gnuplot decoder to prevent Gnuplot-shell based sh ...

oval:org.secpod.oval:def:112159
GraphicsMagick is a comprehensive image processing package which is initially based on ImageMagick 5.5.2, but which has undergone significant re-work by the GraphicsMagick Group to significantly improve the quality and performance of the software.

oval:org.secpod.oval:def:111593
This package contains an implementation of the image compression standard JPEG-2000, Part 1. It consists of tools for conversion to and from the JP2 and JPC formats.

oval:org.secpod.oval:def:111590
This package contains an implementation of the image compression standard JPEG-2000, Part 1. It consists of tools for conversion to and from the JP2 and JPC formats.

oval:org.secpod.oval:def:111685
MoinMoin is an advanced, easy to use and extensible WikiEngine with a large community of users. Said in a few words, it is about collaboration on easily editable web pages.

oval:org.secpod.oval:def:703366
moin: Collaborative hypertext environment Several security issues were fixed in MoinMoin.

oval:org.secpod.oval:def:603147
Multiple vulnerabilities in OpenJPEG, a JPEG 2000 image compression / decompression library, may result in denial of service or the execution of arbitrary code if a malformed JPEG 2000 file is processed.

oval:org.secpod.oval:def:602672
Several cross-site scripting vulnerabilities were discovered in moin, a Python clone of WikiWiki. A remote attacker can conduct cross-site scripting attacks via the GUI editor"s attachment dialogue , the AttachFile view and the GUI editor"s link dialogue .

oval:org.secpod.oval:def:111655
MoinMoin is an advanced, easy to use and extensible WikiEngine with a large community of users. Said in a few words, it is about collaboration on easily editable web pages.

oval:org.secpod.oval:def:39468
pillow: Python Imaging Library Several security issues were fixed in Pillow.

oval:org.secpod.oval:def:703513
pillow: Python Imaging Library Several security issues were fixed in Pillow.

oval:org.secpod.oval:def:703515
python-imaging: Python Imaging Library Several security issues were fixed in the Python Imaging Library.

oval:org.secpod.oval:def:602663
Cris Neckar discovered multiple vulnerabilities in Pillow, a Python imaging library, which may result in the execution of arbitrary code or information disclosure if a malformed image file is processed.

oval:org.secpod.oval:def:38110
The host is installed with Wireshark 2.0.x before 2.0.8 or 2.2.x before 2.2.2 and is prone to a denial of service vulnerability. A flaw is present in the AllJoyn dissector, which fails to properly handle network traffic or a capture file. Successful exploitation allow attackers to crash the service ...

oval:org.secpod.oval:def:38111
The host is installed with Wireshark 2.0.x before 2.0.8 or 2.2.x before 2.2.2 and is prone to an use-after-free vulnerability. A flaw is present in the DCERPC dissector, which fails to properly handle network traffic or a capture file. Successful exploitation allow attackers to crash the service wit ...

oval:org.secpod.oval:def:38109
The host is installed with Wireshark 2.0.x before 2.0.8 or 2.2.x before 2.2.2 and is prone to an unspecified vulnerability. A flaw is present in the OpenFlow dissector, which fails to properly handle network traffic or a capture file. Successful exploitation allow attackers to crash the service by f ...

oval:org.secpod.oval:def:38101
The host is installed with Wireshark 2.0.x before 2.0.7 or 2.2.x before 2.2.2 and is prone to a denial of service vulnerability. A flaw is present in the OpenFlow dissector, which fails to properly handle network traffic or a capture file. Successful exploitation allow attackers to crash the service ...

oval:org.secpod.oval:def:38102
The host is installed with Wireshark 2.0.x before 2.0.8 or 2.2.x before 2.2.2 and is prone to an unspecified vulnerability. A flaw is present in the OpenFlow dissector, which fails to properly handle network traffic or a capture file. Successful exploitation allow attackers to crash the service by f ...

oval:org.secpod.oval:def:38103
The host is installed with Wireshark 2.0.x before 2.0.8 or 2.2.x before 2.2.2 and is prone to a denial of service vulnerability. A flaw is present in the AllJoyn dissector, which fails to properly handle network traffic or a capture file. Successful exploitation allow attackers to crash the service ...

oval:org.secpod.oval:def:38104
The host is installed with Wireshark 2.0.x before 2.0.8 or 2.2.x before 2.2.2 and is prone to an use-after-free vulnerability. A flaw is present in the DCERPC dissector, which fails to properly handle network traffic or a capture file. Successful exploitation allow attackers to crash the service wit ...

oval:org.secpod.oval:def:38108
The host is installed with Wireshark 2.0.x before 2.0.8 or 2.2.x before 2.2.2 and is prone to a denial of service vulnerability. A flaw is present in the OpenFlow dissector, which fails to properly handle network traffic or a capture file. Successful exploitation allow attackers to crash the service ...

oval:org.secpod.oval:def:602678
It was discovered that wireshark, a network protocol analyzer, contained several vulnerabilities in the dissectors for DCERPC, AllJoyn, DTN, and OpenFlow, that could lead to various crashes, denial-of-service, or execution of arbitrary code.

oval:org.secpod.oval:def:602683
Chris Evans discovered that the GStreamer 1.0 plugin used to decode files in the FLIC format allowed execution of arbitrary code. Further details can be found in his advisory at https://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-advancing-exploitation.html

oval:org.secpod.oval:def:602682
Chris Evans discovered that the GStreamer 0.10 plugin used to decode files in the FLIC format allowed execution of arbitrary code. Further details can be found in his advisory at https://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-advancing-exploitation.html This update removes the insecure ...

oval:org.secpod.oval:def:111653
GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or ...

oval:org.secpod.oval:def:111688
GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or ...

oval:org.secpod.oval:def:111755
GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or ...

oval:org.secpod.oval:def:111714
GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or ...

oval:org.secpod.oval:def:204071
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix: * Multiple flaws were discovered in GStreamer"s FLC/FLI/FLX ...

oval:org.secpod.oval:def:204070
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix: * Multiple flaws were discovered in GStreamer"s FLC/FLI/FLX m ...

oval:org.secpod.oval:def:204063
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix: * Multiple flaws were discovered in GStreamer"s FLC/FLI/FLX m ...

oval:org.secpod.oval:def:1501725
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix: * Multiple flaws were discovered in GStreamer"s FLC/FLI/FLX ...

oval:org.secpod.oval:def:501952
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix: * Multiple flaws were discovered in GStreamer"s FLC/FLI/FLX m ...

oval:org.secpod.oval:def:501958
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix: * Multiple flaws were discovered in GStreamer"s FLC/FLI/FLX m ...

oval:org.secpod.oval:def:501957
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix: * Multiple flaws were discovered in GStreamer"s FLC/FLI/FLX ...

oval:org.secpod.oval:def:1501718
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix: * Multiple flaws were discovered in GStreamer"s FLC/FLI/FLX m ...

oval:org.secpod.oval:def:1501724
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix: * Multiple flaws were discovered in GStreamer"s FLC/FLI/FLX m ...

oval:org.secpod.oval:def:602717
Gergely Nagy from Tresorit discovered that libcrypto++, a C++ cryptographic library, contained a bug in several ASN.1 parsing routines. This would allow an attacker to remotely cause a denial of service.

oval:org.secpod.oval:def:602705
It was discovered that the Flight Gear flight simulator performs insufficient sanitising of Nasal scripts which allows a malicious script to overwrite arbitrary files with the privileges of the user running Flight Gear.

oval:org.secpod.oval:def:111856
The Flight Gear project is working to create a sophisticated flight simulator framework for the development and pursuit of interesting flight simulator ideas. We are developing a solid basic sim that can be expanded and improved upon by anyone interested in contributing

oval:org.secpod.oval:def:111862
The Flight Gear project is working to create a sophisticated flight simulator framework for the development and pursuit of interesting flight simulator ideas. We are developing a solid basic sim that can be expanded and improved upon by anyone interested in contributing

oval:org.secpod.oval:def:602714
Bjoern Jacke discovered that Exim, Debian"s default mail transfer agent, may leak the private DKIM signing key to the log files if specific configuration options are met.

oval:org.secpod.oval:def:602706
It was discovered that bottle, a WSGI-framework for the Python programming language, did not properly filter "\r\n" sequences when handling redirections. This allowed an attacker to perform CRLF attacks such as HTTP header injection.

oval:org.secpod.oval:def:703417
exim4: Exim is a mail transport agent Exim could be made to expose private DKIM signing keys.

oval:org.secpod.oval:def:1600510
It was found that Exim leaked DKIM signing private keys to the "mainlog" log file. As a result, an attacker with access to system log files could potentially access these leaked DKIM private keys.

oval:org.secpod.oval:def:112987
The supervisor is a client/server system that allows its users to control a number of processes on UNIX-like operating systems.

oval:org.secpod.oval:def:112974
The supervisor is a client/server system that allows its users to control a number of processes on UNIX-like operating systems.

oval:org.secpod.oval:def:112994
The supervisor is a client/server system that allows its users to control a number of processes on UNIX-like operating systems.

oval:org.secpod.oval:def:603039
Calum Hutton reported that the XML-RPC server in supervisor, a system for controlling process state, does not perform validation on requested XML-RPC methods, allowing an authenticated client to send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server as t ...

oval:org.secpod.oval:def:703775
cvs: Concurrent Versions System cvs could be made run programs as your login if it opened a specially crafted cvs repository.

oval:org.secpod.oval:def:113104
CVS is a version control system that can record the history of your files . CVS only stores the differences between versions, instead of every version of every file you have ever created. CVS also keeps a log of who, when, and why changes occurred. CVS is very helpful for managing releases and cont ...

oval:org.secpod.oval:def:113100
CVS is a version control system that can record the history of your files . CVS only stores the differences between versions, instead of every version of every file you have ever created. CVS also keeps a log of who, when, and why changes occurred. CVS is very helpful for managing releases and cont ...

oval:org.secpod.oval:def:603048
It was discovered that CVS, a centralised version control system, did not correctly handle maliciously constructed repository URLs, which allowed an attacker to run an arbitrary shell command.

oval:org.secpod.oval:def:603076
Security consultants in NRI Secure Technologies discovered a stack overflow vulnerability in ConnMan, a network manager for embedded devices. An attacker with control of the DNS responses to the DNS proxy in ConnMan might crash the service and, in same cases, remotely execute arbitrary commands in t ...

oval:org.secpod.oval:def:603132
Several vulnerabilities have been discovered in the X.Org X server. An attacker who"s able to connect to an X server could cause a denial of service or potentially the execution of arbitrary code.

oval:org.secpod.oval:def:703851
xorg-server: X.Org X11 server - xorg-server-hwe-16.04: X.Org X11 server - xorg-server-lts-xenial: X.Org X11 server Several security issues were fixed in the X.Org X server.

oval:org.secpod.oval:def:703816
emacs24: GNU Emacs editor Emacs could be made to run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:703813
emacs25: GNU Emacs editor Emacs could be made to run programs as your login if it opened a specially crafted file.

oval:org.secpod.oval:def:113169
K-3D is a complete 3D modeling, animation and rendering system. K-3D features a robust, object oriented plugin architecture, designed to scale to the needs of professional artists. It is designed from the ground up to generate motion picture quality animation using RenderMan compliant render engines ...

oval:org.secpod.oval:def:502138
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language , and the capability to read e-mail and news. Security Fix: * A command injection flaw within the Emacs "enriched mode" handling has been discovered. By tric ...

oval:org.secpod.oval:def:1600787
Command injection flaw within "enriched mode" handling:A command injection flaw within the Emacs "enriched mode" handling has been discovered. By tricking an unsuspecting user into opening a specially crafted file using Emacs, a remote attacker could exploit this flaw to execute arbitrary ...

oval:org.secpod.oval:def:113196
pfstools is a set of command line programs for reading, writing, manipulating and viewing high-dynamic range images and video frames. All programs in the package exchange data using unix pipes and a simple generic HDR image format . The concept of the pfstools is similar to netpbm package for low-d ...

oval:org.secpod.oval:def:113198
Synfig is a powerful, industrial-strength vector-based 2D animation software, designed from the ground-up for producing feature-film quality animation with fewer people and resources. It is designed to be capable of producing feature-film quality animation. It eliminates the need for tweening, preve ...

oval:org.secpod.oval:def:113192
Q is a powerful and extensible functional programming language based on the term rewriting calculus. You specify an arbitrary system of equations which the interpreter uses as rewrite rules to reduce expressions to normal form. Q is useful for scientific programming and other advanced applications, ...

oval:org.secpod.oval:def:113194
Synfig Animation Studio is a powerful, industrial-strength vector-based 2D animation software, designed from the ground-up for producing feature-film quality animation with fewer people and resources. It is designed to be capable of producing feature-film quality animation. It eliminates the need fo ...

oval:org.secpod.oval:def:113190
A command line tool for generating timing diagrams from ASCII input files. The input files use a structured language to represent signal state transitions and interdependencies. Raster image output support is provided by ImageMagick. It can be used for VHDL or verilog presentations.

oval:org.secpod.oval:def:113185
Window Maker is an X11 window manager designed to give additional integration support to the GNUstep Desktop Environment. In every way possible, it reproduces the elegant look and feel of the NEXTSTEP GUI. It is fast, feature rich, easy to configure, and easy to use. In addition, Window Maker works ...

oval:org.secpod.oval:def:113182
RMagick is an interface between Ruby and ImageMagick.

oval:org.secpod.oval:def:113180
KXStitch can be used to create cross stitch patterns from scratch. It is also possible to convert existing images to a cross stitch pattern or scan one with a Sane supported scanner.

oval:org.secpod.oval:def:113234
Gtatool is a command line tool to manipulate GTAs. It provides a set of commands that manipulate GTAs on various levels: array element components, array dimensions, whole arrays, and streams of arrays. For example, you can add components to array elements, merge separate arrays into combined arrays ...

oval:org.secpod.oval:def:113235
Converseen is a batch image conversion tool and resizer written in C++ with Qt5 and Magick++. Converseen allows you to convert images in more than 100 different formats!

oval:org.secpod.oval:def:113231
ImageInfo computes and displays selected image attributes. It is similar in function to the ImageMagick "identify" utility, but provides a few additional attributes , and allows command line selection of the attributes to be computed, avoiding unnecessary computation and and allowing easie ...

oval:org.secpod.oval:def:113226
A port of the Really Slick Screensavers to GLX. Provides several visually impressive and graphically intensive screensavers. Note that this package contains only the display hacks themselves; you will need to install the appropriate subpackage for your desktop environment in order to use them as scr ...

oval:org.secpod.oval:def:113228
Emacs is a powerful, customizable, self-documenting, modeless text editor. Emacs contains special code editing features, a scripting language , and the capability to read mail, news, and more without leaving the editor. This package provides an emacs binary with support for X windows.

oval:org.secpod.oval:def:113229
imagick is a native php extension to create and modify images using the ImageMagick API.

oval:org.secpod.oval:def:113224
Scraper2vdr acts as client and provides scraped metadata for tvshows and movies from epgd to other plugins via its service interface. The plugin cares about caching the images locally and also cleans up the images if not longer needed. epgd itself uses the thetvdb.com API for collecting series metad ...

oval:org.secpod.oval:def:113244
VIPS is an image processing library. It is good for very large images , and for working with color. This package should be installed if you want to use a program compiled against VIPS.

oval:org.secpod.oval:def:113240
Techne is a general purpose, programmable physical simulator and renderer. It reads in a set of scripts wherein every aspect of a physical system is specified and then proceeds to simulate and render the system onscreen.

oval:org.secpod.oval:def:113242
Perl module to aide in locating a sub-image within an image.

oval:org.secpod.oval:def:113219
ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed work i ...

oval:org.secpod.oval:def:113215
A conversion utility for the Psion files

oval:org.secpod.oval:def:113216
AutoTrace is a program for converting bitmaps to vector graphics. Supported input formats include BMP, TGA, PNM, PPM, and any format supported by ImageMagick, whereas output can be produced in Postscript, SVG, xfig, SWF, and others.

oval:org.secpod.oval:def:113218
Inkscape is a vector graphics editor, with capabilities similar to Illustrator, CorelDraw, or Xara X, using the W3C standard Scalable Vector Graphics file format. It is therefore a very useful tool for web designers and as an interchange format for desktop publishing. Inkscape supports many advance ...

oval:org.secpod.oval:def:113213
RipRight is a minimal CD ripper modeled on autorip. It can run as a daemon and will automatically start ripping any CD found in the drive after which the disc will be ejected. Ripping is always to FLAC lossless audio format with tags taken from the community-maintained MusicBrainz lookup service and ...

oval:org.secpod.oval:def:204557
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language , and the capability to read e-mail and news. Security Fix: * A command injection flaw within the Emacs "enriched mode" handling has been discovered. By tric ...

oval:org.secpod.oval:def:703837
git: fast, scalable, distributed revision control system Git be made to run programs if it processed a specially crafted file.

oval:org.secpod.oval:def:703881
openssl: Secure Socket Layer cryptographic library and tools Several security issues were fixed in OpenSSL.

oval:org.secpod.oval:def:602747
It was discovered that mapserver, a CGI-based framework for Internet map services, was vulnerable to a stack-based overflow. This issue allowed a remote user to crash the service, or potentially execute arbitrary code.

oval:org.secpod.oval:def:111952
Mapserver is an internet mapping program that converts GIS data to map images in real time. With appropriate interface pages, Mapserver can provide an interactive internet map based on custom GIS data.

oval:org.secpod.oval:def:602765
Luc Lynx discovered that SVG Salamander, a SVG engine for Java was susceptible to server side request forgery.

oval:org.secpod.oval:def:602915
It was discovered that Zookeeper, a service for maintaining configuration information, didn"t restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption. This update disables those two commands by default. The new configura ...

oval:org.secpod.oval:def:602770
Thomas Gerbet discovered that viewvc, a web interface for CVS and Subversion repositories, did not properly sanitize user input. This problem resulted in a potential Cross-Site Scripting vulnerability.

oval:org.secpod.oval:def:112117
MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on scr ...

oval:org.secpod.oval:def:112200
MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on scr ...

oval:org.secpod.oval:def:703475
tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Tomcat could be made to consume resources if it received specially crafted network traffic.

oval:org.secpod.oval:def:1600692
The QuantumTransferMode function in coders/tiff.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service via a small samples per pixel value in a CMYKA TIFF file.The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial o ...

oval:org.secpod.oval:def:703814
libgd2: GD Graphics Library GD library could be made to crash if it opened a specially crafted file.

oval:org.secpod.oval:def:113156
A library for reading and converting Windows MetaFile vector graphics .

oval:org.secpod.oval:def:113112
The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the fo ...

oval:org.secpod.oval:def:113124
The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the fo ...

oval:org.secpod.oval:def:113247
A library for reading and converting Windows MetaFile vector graphics .

oval:org.secpod.oval:def:603085
A double-free vulnerability was discovered in the gdImagePngPtr function in libgd2, a library for programmatic graphics creation and manipulation, which may result in denial of service or potentially the execution of arbitrary code if a specially crafted file is processed.

oval:org.secpod.oval:def:602833
Ilja Van Sprundel discovered that the dmcrypt-get-device helper used to check if a given device is an encrypted device handled by devmapper, and used in eject, does not check return values from setuid and setgid when dropping privileges.

oval:org.secpod.oval:def:703542
eject: ejects CDs and operates CD-Changers under Linux Eject could be made to run programs as an administrator.

oval:org.secpod.oval:def:502084
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work ...

oval:org.secpod.oval:def:602873
Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted login shell for Git-only SSH access, allows a user to run an interactive pager by causing it to spawn "git upload-pack --help".

oval:org.secpod.oval:def:1600711
Escape out of git-shellA flaw was found in the way git-shell handled command-line options for the restricted set of git-shell commands. A remote authenticated attacker could use this flaw to bypass git-shell restrictions, to view and manipulate files, by abusing the instance of the less command laun ...

oval:org.secpod.oval:def:112363
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The git rpm installs common set of tools which are usually using with small amount of dependencies. To install all git packages, incl ...

oval:org.secpod.oval:def:703599
git: fast, scalable, distributed revision control system Git could be made to expose sensitive information over the network.

oval:org.secpod.oval:def:112423
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The git rpm installs common set of tools which are usually using with small amount of dependencies. To install all git packages, incl ...

oval:org.secpod.oval:def:42353
The host is missing a security update 4041681

oval:org.secpod.oval:def:42351
The host is missing a security update 4042895

oval:org.secpod.oval:def:42356
The host is missing a security update 4041689

oval:org.secpod.oval:def:42355
The host is missing a security update 4041691

oval:org.secpod.oval:def:42359
The host is missing a security update 4041687

oval:org.secpod.oval:def:42361
The host is missing a security update 4041693

oval:org.secpod.oval:def:42360
The host is missing a security update 4041676

oval:org.secpod.oval:def:42364
The host is missing a security update 4041678

oval:org.secpod.oval:def:42357
The host is missing a security update 4041690

oval:org.secpod.oval:def:42363
The host is missing a security update 4041679

oval:org.secpod.oval:def:703803
apache2: Apache HTTP server Apache HTTP Server could be made to expose sensitive information over the network.

oval:org.secpod.oval:def:1502033
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:1502039
Several security issues were fixed in httpd.

oval:org.secpod.oval:def:603112
Hanno Boeck discovered that incorrect parsing of Limit directives of .htaccess files by the Apache HTTP Server could result in memory disclosure.

oval:org.secpod.oval:def:502150
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix: * A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker ...

oval:org.secpod.oval:def:502156
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix: * A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker ...

oval:org.secpod.oval:def:1600776
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user"s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. ...

oval:org.secpod.oval:def:113262
The Apache HTTP Server is a powerful, efficient, and extensible web server.

oval:org.secpod.oval:def:204571
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix: * A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker ...

oval:org.secpod.oval:def:109185
Network Security Services is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security stan ...

oval:org.secpod.oval:def:108232
The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols. This package contains Windows libraries and development tools.

oval:org.secpod.oval:def:108229
The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols. This package contains Windows libraries and development tools.

oval:org.secpod.oval:def:107815
The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.

oval:org.secpod.oval:def:107818
The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.

oval:org.secpod.oval:def:1500771
Updated openssl packages that contain a backported patch to mitigate the CVE-2014-3566 issue and fix two security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System ba ...

oval:org.secpod.oval:def:1500775
Updated openssl packages that contain a backported patch to mitigate the CVE-2014-3566 issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. OpenSSL is a toolkit that implements the Secure Sockets Layer , Transport ...

oval:org.secpod.oval:def:1600038
A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining mode. This flaw allows a man-in-the-middle attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim applic ...

oval:org.secpod.oval:def:203465
OpenSSL is a toolkit that implements the Secure Sockets Layer, Transport Layer Security, and Datagram Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. This update adds support for the TLS Fallback Signaling Cipher Suite Value, which can be used to ...

oval:org.secpod.oval:def:203457
OpenSSL is a toolkit that implements the Secure Sockets Layer, Transport Layer Security, and Datagram Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. This update adds support for the TLS Fallback Signaling Cipher Suite Value, which can be used to ...

oval:org.secpod.oval:def:203456
OpenSSL is a toolkit that implements the Secure Sockets Layer, Transport Layer Security, and Datagram Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. This update adds support for the TLS Fallback Signaling Cipher Suite Value, which can be used to ...

oval:org.secpod.oval:def:108059
Node.js is a platform built on Chrome"s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

oval:org.secpod.oval:def:108052
libuv is a new platform layer for Node. Its purpose is to abstract IOCP on Windows and libev on Unix systems. We intend to eventually contain all platform differences in this library.

oval:org.secpod.oval:def:108053
libuv is a new platform layer for Node. Its purpose is to abstract IOCP on Windows and libev on Unix systems. We intend to eventually contain all platform differences in this library.

oval:org.secpod.oval:def:108055
Node.js is a platform built on Chrome"s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

oval:org.secpod.oval:def:108125
libuv is a new platform layer for Node. Its purpose is to abstract IOCP on Windows and libev on Unix systems. We intend to eventually contain all platform differences in this library.

oval:org.secpod.oval:def:21398
The host is installed with OpenSSL 1.0.1 before 1.0.1j, 1.0.0 before 1.0.0o or 0.9.8 before 0.9.8zc or Oracle Java SE 5.0u75 and earlier, 6u85 and earlier, 7u72 and earlier or 8u25 and earlier and is prone to a man-in-the-middle attack vulnerability. A flaw is present in the applications, which fail ...

oval:org.secpod.oval:def:108506
Node.js is a platform built on Chrome"s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

oval:org.secpod.oval:def:601940
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, information disclosure or denial of service.

oval:org.secpod.oval:def:601937
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, information disclosure or denial of service.

oval:org.secpod.oval:def:108196
Node.js is a platform built on Chrome"s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

oval:org.secpod.oval:def:108187
Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware.

oval:org.secpod.oval:def:108269
Claws Mail is an email client , based on GTK+, featuring quick response, graceful and sophisticated interface, easy configuration, intuitive operation, abundant features, and extensibility.

oval:org.secpod.oval:def:203504
Network Security Services is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime provides platform independence for non-GUI operating system facilities. This update adds support for the TLS Fallback Sig ...

oval:org.secpod.oval:def:203509
Network Security Services is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime provides platform independence for non-GUI operating system facilities. This update adds support for the TLS Fallback Sig ...

oval:org.secpod.oval:def:109595
Fossil is a simple, high-reliability, distributed software configuration management with distributed bug tracking, distributed wiki and built-in web interface.

oval:org.secpod.oval:def:203508
Network Security Services is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime provides platform independence for non-GUI operating system facilities. This update adds support for the TLS Fallback Sig ...

oval:org.secpod.oval:def:108267
The purpose of this mail library is to provide a portable, efficient middle-ware for different kinds of mail access. When using the drivers interface, the interface is the same for all kinds of mail access, remote and local mailboxes.

oval:org.secpod.oval:def:109589
Fossil is a simple, high-reliability, distributed software configuration management with distributed bug tracking, distributed wiki and built-in web interface.

oval:org.secpod.oval:def:203540
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were found in the way the Hotspot component in OpenJDK verified bytecode from the class files, and in the way this component generated code for bytecode. An ...

oval:org.secpod.oval:def:203546
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to ...

oval:org.secpod.oval:def:203545
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to ...

oval:org.secpod.oval:def:203543
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to ...

oval:org.secpod.oval:def:203548
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to ...

oval:org.secpod.oval:def:203547
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to ...

oval:org.secpod.oval:def:203539
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to ...

oval:org.secpod.oval:def:602383
lighttpd, a small webserver, is vulnerable to the POODLE attack via the use of SSLv3. This protocol is now disabled by default.

oval:org.secpod.oval:def:23618
The host is missing a patch containing a security fixes, which affects the following package(s): Java

oval:org.secpod.oval:def:1200135
Multiple flaws were found in the way the Hotspot component in OpenJDK verified bytecode from the class files, and in the way this component generated code for bytecode. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions. Multiple improper permi ...

oval:org.secpod.oval:def:1500884
Updated java-1.8.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, are avai ...

oval:org.secpod.oval:def:1500883
Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, are avai ...

oval:org.secpod.oval:def:1500886
Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, are ...

oval:org.secpod.oval:def:1500888
Updated java-1.6.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings ...

oval:org.secpod.oval:def:1500889
Updated java-1.6.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings ...

oval:org.secpod.oval:def:1500891
Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, are ...

oval:org.secpod.oval:def:1500892
Updated java-1.6.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings ...

oval:org.secpod.oval:def:108280
Additional plugins for Claws Mail.

oval:org.secpod.oval:def:501405
OpenSSL is a toolkit that implements the Secure Sockets Layer , Transport Layer Security , and Datagram Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. This update adds support for the TLS Fallback Signaling Cipher Suite Value , which can be use ...

oval:org.secpod.oval:def:501427
OpenSSL is a toolkit that implements the Secure Sockets Layer , Transport Layer Security , and Datagram Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. This update adds support for the TLS Fallback Signaling Cipher Suite Value , which can be use ...

oval:org.secpod.oval:def:501486
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to ...

oval:org.secpod.oval:def:501489
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to ...

oval:org.secpod.oval:def:501491
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to ...

oval:org.secpod.oval:def:501490
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were found in the way the Hotspot component in OpenJDK verified bytecode from the class files, and in the way this component generated code for bytecode. An ...

oval:org.secpod.oval:def:1200086
A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. Multiple improper permission check issues were discovered in the JAX-WS, and RMI components i ...

oval:org.secpod.oval:def:21535
The host is missing a patch containing a security fixes, which affects the following package(s): openssl.base

oval:org.secpod.oval:def:107878
Claws Mail is an email client , based on GTK+, featuring quick response, graceful and sophisticated interface, easy configuration, intuitive operation, abundant features, and extensibility.

oval:org.secpod.oval:def:602094
Pound, a HTTP reverse proxy and load balancer, had several issues related to vulnerabilities in the Secure Sockets Layer protocol. For Debian 7 this update adds a missing part to make it actually possible to disable client-initiated renegotiation and disables it by default . TLS compression is dis ...

oval:org.secpod.oval:def:107894
The Pound program is a reverse proxy, load balancer and HTTPS front-end for Web server. Pound was developed to enable distributing the load among several Web-servers and to allow for a convenient SSL wrapper for those Web servers that do not offer it natively. Pound is distributed under the GPL - no ...

oval:org.secpod.oval:def:107898
A small library for communicating with the REST interface of a Red Hat Unified Entitlement Platform. This interface is used for the management of system entitlements, certificates, and access to content.

oval:org.secpod.oval:def:501462
Network Security Services is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime provides platform independence for non-GUI operating system facilities. This update adds support for the TLS Fallback Sig ...

oval:org.secpod.oval:def:107890
The purpose of this mail library is to provide a portable, efficient middle-ware for different kinds of mail access. When using the drivers interface, the interface is the same for all kinds of mail access, remote and local mailboxes.

oval:org.secpod.oval:def:21591
The host is missing a patch containing a security fixes, which affects the following package(s): Java

oval:org.secpod.oval:def:107888
A small library for communicating with the REST interface of a Red Hat Unified Entitlement Platform. This interface is used for the management of system entitlements, certificates, and access to content.

oval:org.secpod.oval:def:107880
Additional plugins for Claws Mail.

oval:org.secpod.oval:def:107882
The Subscription Manager package provides programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.

oval:org.secpod.oval:def:1600161
Running yum clean all followed by yum update openssl will install the fixed package.For Amazon Linux AMIs "locked" to the 2014.03 repositories, openssl-1.0.1i-1.79.amzn1 also addresses this CVE. Running yum clean all followed by yum update openssl will install the fixed package.For Amazon Linux AMIs ...

oval:org.secpod.oval:def:204279
OpenSSL is a toolkit that implements the Secure Sockets Layer , Transport Layer Security , and Datagram Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. This update adds support for the TLS Fallback Signaling Cipher Suite Value , which can be use ...

oval:org.secpod.oval:def:107915
The Pound program is a reverse proxy, load balancer and HTTPS front-end for Web server. Pound was developed to enable distributing the load among several Web-servers and to allow for a convenient SSL wrapper for those Web servers that do not offer it natively. Pound is distributed under the GPL - no ...

oval:org.secpod.oval:def:1500761
Updated openssl packages that contain a backported patch to mitigate the CVE-2014-3566 issue and fix two security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System ba ...

oval:org.secpod.oval:def:1200041
A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. Multiple improper permission check issues were discovered in the JAX-WS, and RMI components i ...

oval:org.secpod.oval:def:702395
openjdk-7: Open Source Java implementation Several security issues were fixed in OpenJDK 7.

oval:org.secpod.oval:def:702397
openjdk-6: Open Source Java implementation Several security issues were fixed in OpenJDK 6.

oval:org.secpod.oval:def:108462
Node.js is a platform built on Chrome"s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

oval:org.secpod.oval:def:1500862
Updated nss, nss-util, and nss-softokn packages that contain a patch to mitigate the CVE-2014-3566 issue, fix a number of bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. ...

oval:org.secpod.oval:def:1500803
Updated nss, nss-util, and nss-softokn packages that contain a patch to mitigate the CVE-2014-3566 issue, fix a number of bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. ...

oval:org.secpod.oval:def:601802
Several vulnerabilities have been found in OpenSSL, the Secure Sockets Layer library and toolkit. CVE-2014-3513 A memory leak flaw was found in the way OpenSSL parsed the DTLS Secure Real-time Transport Protocol extension data. A remote attacker could send multiple specially crafted handshake messa ...

oval:org.secpod.oval:def:1501059
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An out-of-bounds read flaw was found in the X509_cmp_time function of OpenSSL. A specially crafted X.509 certificate or a Certific ...

oval:org.secpod.oval:def:108520
The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.

oval:org.secpod.oval:def:108338
The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.

oval:org.secpod.oval:def:1500949
Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.

oval:org.secpod.oval:def:1500950
Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.

oval:org.secpod.oval:def:1502038
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:1502037
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:603131
Mathy Vanhoef of the imec-DistriNet research group of KU Leuven discovered multiple vulnerabilities in the WPA protocol, used for authentication in wireless networks. Those vulnerabilities applies to both the access point and the station . An attacker exploiting the vulnerabilities could force the ...

oval:org.secpod.oval:def:502151
The wpa_supplicant packages contain an 802.1X Supplicant with support for WEP, WPA, WPA2 , and various EAP authentication methods. They implement key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver. S ...

oval:org.secpod.oval:def:502152
The wpa_supplicant packages contain an 802.1X Supplicant with support for WEP, WPA, WPA2 , and various EAP authentication methods. They implement key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver. S ...

oval:org.secpod.oval:def:703860
wpa: client support for WPA and WPA2 Several security issues were fixed in wpa_supplicant.

oval:org.secpod.oval:def:42413
The host is missing a security update KB4042723

oval:org.secpod.oval:def:42412
A spoofing vulnerability exists in the Windows implementation of wireless networking. An attacker who successfully exploited this vulnerability could potentially replay broadcast and/or multicast traffic to hosts on a WPA or WPA 2-protected wireless network. Multiple conditions would need to be met ...

oval:org.secpod.oval:def:42417
A new exploitation technique called key reinstallation attacks (KRACK) affecting WPA2 has been discovered. A remote attacker within Wi-Fi range could exploit this attack to decrypt Wi-Fi traffic or inject forged Wi-Fi packets by manipulating cryptograhpic handshakes used by the WPA2 protocol.

oval:org.secpod.oval:def:42416
A new exploitation technique called key reinstallation attacks (KRACKs) affecting WPA2 has been discovered. A remote attacker within Wi-Fi range could exploit this attack to decrypt Wi-Fi traffic or possibly inject forged Wi-Fi packets by reinstalling a previously used group key (GTK) during a group ...

oval:org.secpod.oval:def:42415
A new exploitation technique called key reinstallation attacks (KRACK) affecting WPA2 has been discovered. A remote attacker within Wi-Fi range could exploit this attack to decrypt Wi-Fi traffic or inject forged Wi-Fi packets by manipulating cryptograhpic handshakes used by the WPA2 protocol.

oval:org.secpod.oval:def:42414
A new exploitation technique called key reinstallation attacks (KRACK) affecting WPA2 has been discovered. A remote attacker within Wi-Fi range could exploit this attack to decrypt Wi-Fi traffic or inject forged Wi-Fi packets by manipulating cryptograhpic handshakes used by the WPA2 protocol.

oval:org.secpod.oval:def:204575
The wpa_supplicant packages contain an 802.1X Supplicant with support for WEP, WPA, WPA2 , and various EAP authentication methods. They implement key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver. S ...

oval:org.secpod.oval:def:204574
The wpa_supplicant packages contain an 802.1X Supplicant with support for WEP, WPA, WPA2 , and various EAP authentication methods. They implement key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver. S ...

oval:org.secpod.oval:def:113319
wpa_supplicant is a WPA Supplicant for Linux, BSD and Windows with support for WPA and WPA2 . Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association ...

oval:org.secpod.oval:def:113323
wpa_supplicant is a WPA Supplicant for Linux, BSD and Windows with support for WPA and WPA2 . Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association ...

oval:org.secpod.oval:def:42419
A new exploitation technique called key reinstallation attacks (KRACKs) affecting WPA2 has been discovered. A remote attacker within Wi-Fi range could exploit this attack to decrypt Wi-Fi traffic or possibly inject forged Wi-Fi packets by reinstalling a previously used integrity group key (IGTK) dur ...

oval:org.secpod.oval:def:42418
A new exploitation technique called key reinstallation attacks (KRACK) affecting WPA2 has been discovered. A remote attacker within Wi-Fi range could exploit this attack to decrypt Wi-Fi traffic or inject forged Wi-Fi packets by manipulating cryptograhpic handshakes used by the WPA2 protocol.

oval:org.secpod.oval:def:42420
A new exploitation technique called key reinstallation attacks (KRACKs) affecting WPA2 has been discovered. A remote attacker within Wi-Fi range could exploit this attack to decrypt Wi-Fi traffic or possibly inject forged Wi-Fi packets by reinstalling a previously used group key (GTK) during a Wirel ...

oval:org.secpod.oval:def:1502044
Several security issues were fixed in wget.

oval:org.secpod.oval:def:603140
Antti Levomaeki, Christian Jalio, Joonas Pihlaja and Juhani Eronen discovered two buffer overflows in the HTTP protocol handler of the Wget download tool, which could result in the execution of arbitrary code when connecting to a malicious HTTP server.

oval:org.secpod.oval:def:502187
The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fix: * A stack-based and a heap-based buffer overflow flaws were found in wget when processing chunked encoded HTTP responses. By tricking an unsuspecting user into connecting to a malicious HT ...

oval:org.secpod.oval:def:1600796
Heap-based buffer overflow in HTTP protocol handlingA heap-based buffer overflow, when processing chunked encoded HTTP responses, was found in wget. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit this flaw to potentially execute arbitrary code. ...

oval:org.secpod.oval:def:703872
wget: retrieves files from the web Several security issues were fixed in Wget.

CVE    598
CVE-2014-4911
CVE-2014-6276
CVE-2014-9746
CVE-2014-9747
...
*CPE
cpe:/o:debian:debian_linux:8.0

© 2013 SecPod Technologies