An APAR fix addresses vulnerabilities in the IBM Eclipse Help System version 3.6.2. They could allow Cross-Site Scripting (XSS) attacks as well as file path traversal. So this fix is recommended.

A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Rational ClearQuest. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. A patch is available now.

A new vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP NetWeaver ABAP. Authentication isn't required to exploit this vulnerability. A patch is available now.

A flaw exists in Avaya IP Office Customer Call Reporter because it allows unauthenticated users to upload files to the webserver through ImageUpload.ashx. The uploaded files will not be stripped of their file extensions and the directory where they are uploaded to has no scripting restrictions. This flaw can lead the remote code execution under the context of the user running the IP Office Customer Call Reporter. Avaya has issued an update to correct this vulnerability.

A potential security vulnerability has been identified with certain HP Photosmart printers. The vulnerability could be exploited remotely to create a Denial-of-Service (DoS). Firmware updates are available now.

It was discovered that malicious clients can trick the server component of the Bcfg2 configuration management system to execute commands with root privileges. This is done via shell command injection.
It has been found that the Spring Framework contains an information disclosure vulnerability in the processing of certain Expression Language (EL) patterns, allowing attackers to access sensitive information using HTTP requests.
Updated packages are available now.

Symantecs Message Filter management interface, the Brightmail Control Center, is susceptible to a number of security concerns resulting from improper input validation and authentication. Successful exploitation of these issues could result in unauthorized privileged access to the application, execution of unauthorized scripts in the context of the targeted users browser or disclosure of application versioning information that could potentially be leveraged in further exploitation attempts. Symantec has verified these issues and has released an update to address them.

A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP NetWeaver ABAP. Authentication isn't required to exploit this vulnerability. A patch is available now.

A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required in that a target must visit a malicious page or open a malicious file. A patch is available now.

Several potential security vulnerabilities have been identified with HP System Management Homepage (SMH) running on Linux and Windows. The vulnerabilities could be exploited remotely resulting in unauthorized access, disclosure of information, data modification, Denial-of-Service (DoS), and execution of arbitrary code. HP has provided HP System Management Homepage v7.1.1 or subsequent to resolve the vulnerabilities.

Sendmail is a common software for all mail purposes. A vulnerability could allow users with an existing account to initiate a Denial-of-Service (DoS) or to compromise the root account. This is due to a bug in handling the .forward file of a user. Updated APARs are available now.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Several vulnerabilities have been found. They allow several attacks like e.g. Denial-of-Service (DoS), access to confidential data or remote execution of arbitrary code. Updated packages are available, they should be installed as soon as possible.

The Cisco WebEx Players are applications that are used to play back WebEx meeting recordings that have been recorded on a WebEx meeting site or on the computer of an online meeting attendee. The Cisco WebEx Recording Format (WRF) player contains four buffer overflow vulnerabilities and the Cisco Advanced Recording Format (ARF) player contains one buffer overflow vulnerability. In some cases, exploitation of the vulnerabilities could allow a remote attacker to execute arbitrary code on the system with the privileges of a targeted user. Cisco has updated affected versions of the WebEx meeting sites and WRF and ARF players to address these vulnerabilities.

Updated libwpd packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

Updated kernel packages that fix various security issues and three bugs are now available for Red Hat Enterprise Linux 6.1 Extended Update Support.

Updated redhat-ds-base packages that fix two security issues are now available for Red Hat Directory Server 8.

A potential security vulnerability has been identified with HP Business Service Management (BSM) . The vulnerability could be remotely exploited to allow unauthorized disclosure of information, unauthorized modification, and Denial of Service (DoS). The vulnerability can be worked around by implementing firewall rules to block traffic from untrusted sources to JBoss TCP ports 4444, 1098, 1099.

Adobe released a security update for Adobe Flash Professional CS5.5 (11.5.1.349 and earlier) for Windows and Macintosh. This update addresses a vulnerability that could allow an attacker who successfully exploits this vulnerability to take control of the affected system.

Updated postgresql84 and postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

Updated postgresql packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

A Security vulnerability has been discovered in the IBM Rational Directory Server (RDS) Help system shipped with the RDS product. When the Help file is opened in Rational Directory Administrator, the 'href' parameter in advanced/deferredView.jsp causes Cross Site Scripting (XSS).

IBM has identified a total of four vulnerabilities in IBM Lotus Expeditor. All four vulnerabilities are resolved by IBM Lotus Expeditor 6.2 FP5+ Security Pack.

IBM System Storage is found to be vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements via the Manager Profiler, which could allow the attacker to view, add, modify or delete information in the back-end database. New updates are available.

It was discovered that that the ElGamal code in PythonCrypto, a collection of cryptographic algorithms and protocols for Python, used insecure insufficient prime numbers in key generation, which lead to a weakened signature or public key space, allowing easier brute force attacks on such keys. New updates are available to address these issue.

Several vulnerabilities were discovered in Xen, a hypervisor. These vulnerabilities may allow denial of service (DoS) and privilege escalation. New updates are available to address these issues.

Several vulnerabilities were discovered in Mantis, an issue tracking system. New updates are available to address these issues.

Several vulnerabilities have been discovered in icedove, the Debian version of the Mozilla Thunderbird mail/news client. There were miscellaneous memory safety hazards and a use-after-free issue. New updates are available.

It was discovered that dhcpcd, a DHCP client, was vulnerable to a stack overflow. A malformed DHCP message could crash the client, causing a denial of service, and potentially remote code execution through properly designed malicous DHCP packets. New updates are available.

A new patch kit is available for OpenVMS to resolve several vulnerabilities.

JBoss Enterprise BRMS Platform 5.3.0, which fixes multiple security issues, various bugs, and adds enhancements is now available from the Red Hat Customer Portal.

Vulnerability in IBM DB2 could allow an authenticated user to view data from a table to which they do not have privileges. New packets are available for download.

Vulnerability in IBM DB2 XML Feature could allow a remote attacker to view XML files owned by the DB2 instance owner. New packets are available for download.

A vulnerability in IBM DB2 could allow an unauthenticated, remote attacker to cause a denial of service. The vulnerability exists in the Distributed Relational Database Architecture (DRDA) module that handles DRDA chaining. A malicious user with knowledge of DRDA could send a specially crafted request to a database server to cause disruptions or a crashes. New packets are available for download.

The Cisco AnyConnect Secure Mobility Client is affected by several vulnerabilities. These may lead to the execution of arbitrary code and denial of service (DoS) attacks. Cisco has released free software updates that address these vulnerabilities.

An Off-by-one error in libxml2 allows remote attackers to cause a Denial-of-Service (DoS) or possibly have unspecified other impact via unknown vectors. An array index error, leading to out-of heap-based buffer read flaw was found in the way net-snmp agent performs entries lookup in the extension table. When a certain MIB subtree is handled by the extend directive, a remote attacker having read privilege to the subtree could use this flaw to cause a Denial-of-Service via SNMP GET request involving a non-existent extension table entry
Updated packages address these issues.

A vulnerability exists in Cisco Application Control Engine (ACE) software. Administrative users may be logged into an unintended context (virtual instance) on the ACE when running in multicontext mode. For this vulnerability to be exploited two or more contexts must be configured with the same management IP address. The administrator must have valid login credentials for the incorrect context when being logged in. Cisco has released free software updates that address this vulnerability.

Cisco ASA 5500 Series Adaptive Security Appliances (Cisco ASA) and Cisco Catalyst 6500 Series ASA Services Module (Cisco ASASM) contain a vulnerability that may allow an unauthenticated, remote attacker to cause the reload of the affected device. This Denial-of-Service (DoS) can only be triggered by IPv6 transit traffic, and affects both Cisco ASA and Cisco ASASM when configured in transparent firewall mode. Cisco has released free software updates that address this vulnerability.

IBM System Storage is vulnerable to SQL injection and multiple Cross-Site Scripting (XSS) attacks. A remote attacker could send specially-crafted SQL statements via the Manager Profiler, which could allow the attacker to view, add, modify or delete information in the back-end database. Besides this, a remote attacker could exploit the XSS vulnerabilities using specially-crafted URL to execute arbitrary scripts in the web browser. Patches seem to be available.

AIX could allow a arbitrary file overwrite symlink vulnerability due to libodm.a bug. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to overwrite arbitrary files on the system with elevated privileges. APARs correcting this problem are available.

It has been found that Quagga, a routing daemon, contains a vulnerability in processing the ORF capability in BGP OPEN messages. A malformed OPEN message from a previously configured BGP peer could cause bgpd to crash, causing a Denial-of-Service. Updated packages are available now.

An update for JBoss Enterprise Application Platform 5.1.2 is available now. It fixes some vulnerabilities regarding unauthorized access.

Vulnerabilities have been found in libvirt, libguestfs, rsyslog, busybox, php-pecl-apc, 389-ds-base, abrt, python, kernel, mysql, net-snmp, qt, openssh, openldap, cifs-utils, xorg-x11, sos, nss, sblim-cim-client2, and java-1.7.0-openjdk. It's recommended to update affected systems as soon as possible.

An insufficient entropy vulnerability in Innominates mGuard network appliance product line has been found. By impersonating the device, an attacker can obtain the credentials of administrative users and potentially perform a Man-in-the-Middle (MitM) attack. Innominate has published an update to address this vulnerability.

A potential security vulnerability has been identified with HP Business Service Management (BSM). The vulnerability could be remotely exploited to allow unauthorized disclosure of information, unauthorized modification, and Denial-of-Service (DoS). A workaround has been published.

A code injection security problem in iehs.war has been found in the IBM WebSphere Application Server. This might allow Cross-Site Scripting (XSS) attacks via the help system of this server. A fix is available now.

Potential security vulnerabilities have been identified with HP-UX CIFS-Server (Samba). The vulnerabilities could be exploited remotely to execute arbitrary code or elevate privileges. HP has provided a software update to resolve the vulnerabilities.

Symantec LiveUpdate Administrator 2.3 and prior install some files with insecure file permissions during a default installation. These files allow full control permission to everyone which could result in arbitrary command execution with elevated privileges on the system. Symantec engineers confirmed the issue and addressed it in Symantec LiveUpdate Administrator 2.3.1.

Several issues have been discovered in the MySQL database server. Users having an existing account might access privileged data. Besides this, security is reduces. Updated packages are available now.

Python is an interpreted, interactive, object-oriented programming language. Several vulnerabilities have been found. They allow Denial-of-Service (DoS), Cross-Site Scripting (XSS) attacks as well as access to confidential data. Updated packages are available now.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Several vulnerablities have been found in the kernel. Users having an existing account might gain increased privileges or unauthorized access as well as the chance to initiate a Denial-of-Service (DoS). Updated kernel packages address these issues.

The TAR file parser in ClamAV 0.96.4 allows remote attackers to bypass malware detection via a TAR archive entry. The Microsoft CHM file parser in ClamAV allows remote attackers to bypass malware detection using a crafted reset interval in the LZXC header of a CHM file.
Multiple vulnerabilities exist in Java for Red Hat Enterprise Linux. They allow remote attackers unautorised access as well as remote code execution and to initiate a Denial-of-Service (DoS).
Updated packages address these issues.

Oracle Mojarra could allow a remote attacker to obtain sensitive information, caused by an error in the FacesContext object. By invoking the FacesContext.getCurrentInstance() function, an attacker could exploit this vulnerability to disclose another WAR's resources and obtain sensitive information. A solution isn't available yet.

Potential security vulnerabilities have been identified with HP-UX Apache Web Server running PHP. These vulnerabilities could be exploited remotely to execute arbitrary code, elevate privileges, or create a Denial-of-Service (DoS). PHP is contained in the HP-UX Apache Web Server Suite. Fixes are available.

In products of VMware like VMware Workstation, VMware Player, VMware Fusion, ESX, and ESXi some vulnerabilities might lead to the execution of arbitrary code or a Denial-of-Service (DoS). Local access is necessary to exploit these vulnerabilities. An Upgrade is available.

Lotus Notes could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user supplied input. By persuading a victim to click on a specially-crafted notes:// URI, an attacker could exploit this vulnerability to execute arbitrary shell commands. This problem will be addressed in Lotus Notes 8.5.3 Fix Pack 2.

The crypt(text, text) function in the pgcrypto contrib module doesn't handle certain passwords correctly when producing traditional DES-based hashes. Characters after the first 0x80 byte were ignored. SECURITY DEFINER and SET attributes for a call handler of a procedural language could crash the database server.
The Phar extension for PHP doesn't properly handle crafted tar files, leading to a heap-based buffer overflow. PHP applications processing tar files could crash or, potentially, execute arbitrary code.
Updated packages are available now.

A potential security vulnerability has been identified with the TCP/IP Services for OpenVMS BIND 9 Resolver. The vulnerability could be remotely exploited to cause a Denial-of-Service (DoS). A fix is available now.

FFmpeg is Debian's version of the Libav media codec suite. It contains vulnerabilities in the DPCM codecs and in H.264, ADPCM as well as the KMVC Decoder. In OpenConnect, a client for the Cisco AnyConnect VPN, a buffer overflow has been discovered. This could result in a Denial-of-Service (DoS).
Updated packages are available now.

A vulnerability in Checkpoint Endpoint Connect VPN causes the client to be susceptible to an attack that result in arbitrary dynamic-library loading by a local user. So this user is able to execute arbitrary code with his rights. A hotfix for Endpoint Security R75 as well as R73.x and E80.x is available now.

An integer overflow flaw, leading to a buffer overflow, was found in the way OpenOffice.org processes an invalid Escher graphics records length in Microsoft Office PowerPoint documents. Besides this, multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the JPEG, PNG, and BMP image file reader implementations in OpenOffice.org. These vulnerabilities can be exploited by attackers providing special documents to their victim. Updated packages are available now.

Expat is a C library for parsing XML documents. A Denial-of-Service (DoS) flaw has been found in the implementation of hash arrays in Expat. Besides this, a memory leak in Expat has been found. Updated packages are available now.

Multiple vulnerabilities exist in Java for Red Hat Enterprise Linux. They allow remote attackers unautorised access as well as remote code execution and to initiate a Denial-of-Service (DoS). Updated packages address these issues.

Asterisk is a free PBX and telephony toolkit for VoIP. The IAX2 channel driver allows remote attackers to cause a Denial-of-Service (DoS) by placing a call on hold under certain conditions. The same can be achieved by remote authenticated users by closing a connection in off-hook mode, because this results in a NULL pointer dereference.
Updated packages are available now.

Multiple vulnerabilities exist in Java for Mac OS X. The most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Java for OS X 2012-004 and Java for Mac OS X 10.6 Update 9 can be downloaded to fix these vulnerabilities.

Adobe released a security hotfix for ColdFusion 9.0.1 and earlier versions for Windows, Macintosh and UNIX. This update resolves an HTTP response splitting vulnerability in the ColdFusion Component Browser. Adobe recommends users update their product installation.

JBoss Operations Network (JBoss ON) is a middleware management solution that provides a single point of control to deploy, manage, and monitor JBoss Enterprise Middleware, applications, and services. The new JBoss ON 3.1.0 release serves as a replacement for JBoss ON 3.0.1. It fixes a security vulnerability and includes several bug fixes and enhancements.

Some 64-bit operating systems and virtualization software running on Intel CPU hardware are vulnerable to a local privilege escalation attack. The vulnerability may be exploited for local privilege escalation or a guest-to-host virtual machine escape. Please refer to your vendor if an update is available.

In the kernel of Red Hat Linux, some vulnerabilities have been found. Exploiting them might lead to remote code execution as well as increased privileges or Denial-of-Service (DoS). Updated packages are available.

No further comment due to legal reasons

No further comment due to legal reasons

No further comment due to legal reasons

No further comment due to legal reasons

No further comment due to legal reasons

No further comment due to legal reasons

No further comment due to legal reasons

Potential security vulnerabilities have been identified with HP Onboard Administrator. These vulnerabilities could be exploited remotely resulting in unauthorized access to data, unauthorized disclosure of information, and Denial of Service (DoS).

A potential security vulnerability has been identified with HP Server Automation for Linux and SunOS. This vulnerability could by exploited remotely resulting in the execution of arbitrary code. The vulnerability is in Samba which is used in HP Server Automation.

Some scripts in the help system used by SPSS Data Collection Developer Library are vulnerable to open redirect or cross-site scripting attacks. New updates are available to address these issues.

ITunes 10.6.3 is now available for download, which plugs two vulnerabilities. A heap buffer overflow existed in the handling of .m3u playlists which may lead to an unexpected application termination or arbitrary code execution. A memory corruption issue existed in WebKit which may lead to an unexpected application termination or arbitrary code execution.

The new release Flash Player 11.3 plugs at least seven security holes in Flash Player and Adobe Air. Attackers may use these flaws to crash the applications and seize control over unpatched systems. Flash updates are available for Windows, Mac, Linux and Android systems. Adobe AIR patches are available for Windows, Mac and Android platforms.

The crypt(text, text) function in the pgcrypto contrib module doesn't handle certain passwords correctly when producing traditional DES-based hashes. Characters after the first 0x80 byte were ignored. SECURITY DEFINER and SET attributes for a call handler of a procedural language could crash the database server.
The Phar extension for PHP doesn't properly handle crafted tar files, leading to a heap-based buffer overflow. PHP applications processing tar files could crash or, potentially, execute arbitrary code.
Updated packages are available now.

Apache CXF could allow a remote attacker to bypass security restrictions in two different ways. An official fix is available now.

Adobe has released security updates for Adobe Flash Player 11.2.202.235 and earlier versions for Windows, Macintosh and Linux, Adobe Flash Player 11.1.115.8 and earlier versions for Android 4.x, and Adobe Flash Player 11.1.111.9 and earlier versions for Android 3.x and 2.x. These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Multiple IBM products are vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the IBM Eclipse Help System deferredView.jsp script. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. Besides this, a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in the Eclipse Help System. An attacker could exploit this vulnerability to redirect a victim to arbitrary Web sites.
The IBM Eclipse Help System (IEHS) 3.4.3 Fix Pack addresses these issues.

The web interface of the ForeScout CounterACT appliance contains reflected XSS vulnerabilities. A remote attacker may, by luring a user into clicking a malicious URL, be able to disclose sensitive information, steal user cookies, or escalate privileges. Updates that should be applied are available now.

Several vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox and in the Iceape internet suite, an unbranded version of Seamonkey. Exploiting them might allow remote code and command execution. Updated packages are available now.

An integer overflow flaw, leading to a buffer overflow, was found in the way OpenOffice.org processes an invalid Escher graphics records length in Microsoft Office PowerPoint documents. Besides this, multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the JPEG, PNG, and BMP image file reader implementations in OpenOffice.org. These vulnerabilities can be exploited by attackers providing special documents to their victim. Updated packages are available now.

OpenSSL is a free software for Transport Layer Security (TLS), formerly SSL. Incorrect integer conversions in OpenSSL DER buffer handling can result in memory corruption. Besides this, a flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and DTLS can be exploited in a Denial-of-Service (DoS) attack on both clients and servers. Updated packages are available now.

Several vulnerabilities have been found in the web browser Firefox and in the MUA Thunderbird. Since some of them are critical, an update is recommended.

IBM AIX is vulnerable to a denial of service, caused by an error in the socketpair() subroutine. A local attacker could exploit this vulnerability to cause the system to crash. A fix is available now.

An integer overflow flaw, leading to a buffer overflow, was found in the way OpenOffice.org processes an invalid Escher graphics records length in Microsoft Office PowerPoint documents. Besides this, multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the JPEG, PNG, and BMP image file reader implementations in OpenOffice.org. These vulnerabilities can be exploited by attackers providing special documents to their victim. Updated packages are available now.

BIND is a very famous server for the Domain Name System (DNS). Processing of DNS resource records where the rdata field is zero length may cause various issues for the servers handling them. This issue primarily affects recursive nameservers. An upgrade addresses this issue.

Quagga is a routing software suite. A Denial-of-Service condition can be caused by an attacker controlling one of the pre-configured BGP peers. In most cases this means, that the attack must be originated from an adjacent network. For most systems, updates are available now.

No further comment due to legal reasons.

A patch for arpwatch (as shipped at least in Red Hat and Debian distributions) in order to make it drop root privileges would fail to do so and instead add the root group to the list of the daemon uses. Libgdata, a library used to access various Google services, isn't validating certificates against trusted system root CAs when using an https connection. Upsd, the server of Network UPS Tools (NUT) is vulnerable to a remote Denial-of-Service attack. Multiple cross-site scripting (XSS) vulnerabilities were discovered in IMP, the webmail component in the Horde framework. The vulnerabilities allow remote attackers to inject arbitrary web script or HTML via various crafted parameters.
Updated packages are available now.

IBM DB2 could allow a remote attacker to bypass security restrictions, caused an error in the XML feature. A remote authenticated attacker could exploit this vulnerability using the XMLPARSE function containing a specially-crafted character string expression to retrieve restricted XML documents. A fix is available now.

IrfanView 4.3.2.0 and 4.3.3.0 are vulnerable to a heap-based buffer overflow, caused by improper bounds checking the ECW plugin (NCSEcw.dll). By persuading a victim to open a specially-crafted FPX file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. IrvanView 4.3.4.0 addresses this vulnerability.

Lotus iNotes 8.5 ActiveX control (dwa85W.dll) is vulnerable to a buffer overflow. By persuading a victim to visit a specially-crafted Web page that passes an overly long argument to the Attachment_Times() insecure method, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the victim's browser to crash. A fix is available now.

Stack-based buffer overflow in magentservice.exe in the server in HP Diagnostics allows remote attackers to execute arbitrary code via a crafted size value in a packet. A new update is available.

An authentication bypass issue was discovered in strongSwan, an IPsec-based VPN solution. When using RSA-based setups, a missing check in the gmp plugin could allow an attacker presenting a forged signature to successfully authenticate against a strongSwan responder. New packets are available for download, to fix this issue.

Cisco IOS XR Software contains a vulnerability when handling crafted packets that may result in a denial of service condition. The vulnerability is a result of improper handling of crafted packets and could cause the route processor, which processes the packets, to be unable to transmit packets to the fabric. Cisco has released free software updates that address this vulnerability