Vulnerability Summary for the Week of March 7, 2016

Inserito da 21 Marzo, 2016 (0) Commenti

Si tratta di :English Articles,ICT and Computer Security

cretino-11-e1334646540518

ITA

Questo articolo è scritto per te che “non capisci di esser abbastanza cretino” e   ti credi molto perspicace e intelligente, una persona che snobba gli articoli e non ha bisogno di niente e prima si iscrive alla newsletter del mio sito e poi si lamenta cancellandosi dalla newsletter.

ENG

This article is written for you that fairly stupid” and you think you’re very perceptive and intelligent, a person who snubs the articles and did not need anything and before he enrolled at the site of my newsletter and then complains removing himself from the newsletter.

 

High Vulnerabilities

Primary
Vendor — Product
Description Published CVSS Score Source & Patch Info
adobe — digital_editions Adobe Digital Editions before 4.5.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. 2016-03-09 10.0 CVE-2016-0954
adobe — acrobat Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1009. 2016-03-09 10.0 CVE-2016-1007
adobe — acrobat Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1007. 2016-03-09 10.0 CVE-2016-1009
adobe — acrobat Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allows local users to gain privileges via a Trojan horse DLL in an unspecified directory. 2016-03-09 7.2 CVE-2016-1008
microsoft — .net_framework Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified document, aka “.NET XML Validation Security Feature Bypass.” 2016-03-09 10.0 CVE-2016-0132
microsoft — infopath Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka “Microsoft Office Memory Corruption Vulnerability.” 2016-03-09 9.3 CVE-2016-0021
microsoft — windows OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka “Windows OLE Memory Remote Code Execution Vulnerability,” a different vulnerability than CVE-2016-0091. 2016-03-09 9.3 CVE-2016-0092
microsoft — windows Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 allow remote attackers to execute arbitrary code via crafted media content, aka “Windows Media Parsing Remote Code Execution Vulnerability.” 2016-03-09 9.3 CVE-2016-0098
microsoft — windows Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow remote attackers to execute arbitrary code via crafted media content, aka “Windows Media Parsing Remote Code Execution Vulnerability.” 2016-03-09 9.3 CVE-2016-0101
microsoft — windows The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka “Windows Remote Code Execution Vulnerability.” 2016-03-09 9.3 CVE-2016-0117
microsoft — windows The PDF library in Microsoft Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka “Windows Remote Code Execution Vulnerability.” 2016-03-09 9.3 CVE-2016-0118
microsoft — windows The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka “OpenType Font Parsing Vulnerability.” 2016-03-09 9.3 CVE-2016-0121
microsoft — office Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, and Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka “Microsoft Office Memory Corruption Vulnerability.” 2016-03-09 9.3 CVE-2016-0134
microsoft — internet_explorer Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Microsoft Browser Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0103, CVE-2016-0106, CVE-2016-0108, CVE-2016-0109, and CVE-2016-0114. 2016-03-09 7.6 CVE-2016-0102
microsoft — internet_explorer Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0102, CVE-2016-0106, CVE-2016-0108, CVE-2016-0109, and CVE-2016-0114. 2016-03-09 7.6 CVE-2016-0103
microsoft — internet_explorer Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability.” 2016-03-09 7.6 CVE-2016-0104
microsoft — internet_explorer Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Microsoft Browser Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0107, CVE-2016-0111, CVE-2016-0112, and CVE-2016-0113. 2016-03-09 7.6 CVE-2016-0105
microsoft — internet_explorer Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0108, CVE-2016-0109, and CVE-2016-0114. 2016-03-09 7.6 CVE-2016-0106
microsoft — internet_explorer Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0105, CVE-2016-0111, CVE-2016-0112, and CVE-2016-0113. 2016-03-09 7.6 CVE-2016-0107
microsoft — internet_explorer Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0106, CVE-2016-0109, and CVE-2016-0114. 2016-03-09 7.6 CVE-2016-0108
microsoft — internet_explorer Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Microsoft Browser Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0106, CVE-2016-0108, and CVE-2016-0114. 2016-03-09 7.6 CVE-2016-0109
microsoft — internet_explorer Microsoft Internet Explorer 10 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Microsoft Browser Memory Corruption Vulnerability.” 2016-03-09 7.6 CVE-2016-0110
microsoft — internet_explorer Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Microsoft Browser Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0105, CVE-2016-0107, CVE-2016-0112, and CVE-2016-0113. 2016-03-09 7.6 CVE-2016-0111
microsoft — internet_explorer Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0105, CVE-2016-0107, CVE-2016-0111, and CVE-2016-0113. 2016-03-09 7.6 CVE-2016-0112
microsoft — internet_explorer Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0105, CVE-2016-0107, CVE-2016-0111, and CVE-2016-0112. 2016-03-09 7.6 CVE-2016-0113
microsoft — internet_explorer Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Internet Explorer Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0106, CVE-2016-0108, and CVE-2016-0109. 2016-03-09 7.6 CVE-2016-0114
microsoft — internet_explorer Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Microsoft Edge Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0123, CVE-2016-0124, CVE-2016-0129, and CVE-2016-0130. 2016-03-09 7.6 CVE-2016-0116
microsoft — edge Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Microsoft Edge Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0116, CVE-2016-0124, CVE-2016-0129, and CVE-2016-0130. 2016-03-09 7.6 CVE-2016-0123
microsoft — edge Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Microsoft Edge Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0116, CVE-2016-0123, CVE-2016-0129, and CVE-2016-0130. 2016-03-09 7.6 CVE-2016-0124
microsoft — edge Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Microsoft Edge Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0116, CVE-2016-0123, CVE-2016-0124, and CVE-2016-0130. 2016-03-09 7.6 CVE-2016-0129
microsoft — edge Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Microsoft Edge Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0116, CVE-2016-0123, CVE-2016-0124, and CVE-2016-0129. 2016-03-09 7.6 CVE-2016-0130
microsoft — office Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 does not properly sign an unspecified binary file, which allows local users to gain privileges via a Trojan horse file with a crafted signature, aka “Microsoft Office Security Feature Bypass Vulnerability.” 2016-03-09 7.2 CVE-2016-0057
microsoft — windows The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka “Win32k Elevation of Privilege Vulnerability,” a different vulnerability than CVE-2016-0094, CVE-2016-0095, and CVE-2016-0096. 2016-03-09 7.2 CVE-2016-0093
microsoft — windows The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka “Win32k Elevation of Privilege Vulnerability,” a different vulnerability than CVE-2016-0093, CVE-2016-0095, and CVE-2016-0096. 2016-03-09 7.2 CVE-2016-0094
microsoft — windows The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka “Win32k Elevation of Privilege Vulnerability,” a different vulnerability than CVE-2016-0093, CVE-2016-0094, and CVE-2016-0096. 2016-03-09 7.2 CVE-2016-0095
microsoft — windows The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka “Win32k Elevation of Privilege Vulnerability,” a different vulnerability than CVE-2016-0093, CVE-2016-0094, and CVE-2016-0095. 2016-03-09 7.2 CVE-2016-0096
microsoft — windows The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka “Secondary Logon Elevation of Privilege Vulnerability.” 2016-03-09 7.2 CVE-2016-0099
microsoft — windows The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via a crafted OpenType font, aka “OpenType Font Parsing Vulnerability.” 2016-03-09 7.1 CVE-2016-0120

Medium Vulnerabilities

Primary
Vendor — Product
Description Published CVSS Score Source & Patch Info
microsoft — windows OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka “Windows OLE Memory Remote Code Execution Vulnerability,” a different vulnerability than CVE-2016-0092. 2016-03-09 6.8 CVE-2016-0091

Low Vulnerabilities

Primary
Vendor — Product
Description Published CVSS Score Source & Patch Info
microsoft — edge Microsoft Edge mishandles the Referer policy, which allows remote attackers to obtain sensitive browser-history and request information via a crafted HTTPS web site, aka “Microsoft Edge Information Disclosure Vulnerability.” 2016-03-09 2.6 CVE-2016-0125

Severity Not Yet Assigned

Primary
Vendor — Product
Description Published CVSS Score Source & Patch Info
Adobe — Flash Player Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005. 2016-03-12 N/A CVE-2016-0960
Adobe — Flash Player Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005. 2016-03-12 N/A CVE-2016-0961
Adobe — Flash Player Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005. 2016-03-12 N/A CVE-2016-0962
Adobe — Flash Player Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0993 and CVE-2016-1010. 2016-03-12 N/A CVE-2016-0963
Adobe — Flash Player Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005. 2016-03-12 N/A CVE-2016-0986
Adobe — Flash Player Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000. 2016-03-12 N/A CVE-2016-0987
Adobe — Flash Player Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000. 2016-03-12 N/A CVE-2016-0988
Adobe — Flash Player Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005. 2016-03-12 N/A CVE-2016-0989
Adobe — Flash Player Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000. 2016-03-12 N/A CVE-2016-0990
Adobe — Flash Player Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000. 2016-03-12 N/A CVE-2016-0991
Adobe — Flash Player Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-1002, and CVE-2016-1005. 2016-03-12 N/A CVE-2016-0992
Adobe — Flash Player Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-1010. 2016-03-12 N/A CVE-2016-0993
Adobe — Flash Player Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code by using the actionCallMethod opcode with crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000. 2016-03-12 N/A CVE-2016-0994
Adobe — Flash Player Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000. 2016-03-12 N/A CVE-2016-0995
Adobe — Flash Player Use-after-free vulnerability in the setInterval method in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000. 2016-03-12 N/A CVE-2016-0996
Adobe — Flash Player Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000. 2016-03-12 N/A CVE-2016-0997
Adobe — Flash Player Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0999, and CVE-2016-1000. 2016-03-12 N/A CVE-2016-0998
Adobe — Flash Player Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-1000. 2016-03-12 N/A CVE-2016-0999
Adobe — Flash Player Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-0999. 2016-03-12 N/A CVE-2016-1000
Adobe — Flash Player Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors. 2016-03-12 N/A CVE-2016-1001
Adobe — Flash Player Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, and CVE-2016-1005. 2016-03-12 N/A CVE-2016-1002
Adobe — Flash Player Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, and CVE-2016-1002. 2016-03-12 N/A CVE-2016-1005
Adobe — Flash Player Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993. 2016-03-12 N/A CVE-2016-1010
Android — mediaserver The MPEG4Source::fragmentedRead function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26365349. 2016-03-12 N/A CVE-2016-0815
Android — mediaserver mediaserver in Android 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to decoder/ih264d_parse_islice.c and decoder/ih264d_parse_pslice.c, aka internal bug 25928803. 2016-03-12 N/A CVE-2016-0816
Android — Conscrypt The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 mishandles the distinction between an intermediate CA and a trusted root CA, which allows man-in-the-middle attackers to spoof servers by leveraging access to an intermediate CA to issue a certificate, aka internal bug 26232830. 2016-03-12 N/A CVE-2016-0818
Android — Qualcomm performance The Qualcomm performance component in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows attackers to gain privileges via a crafted application, aka internal bug 25364034. 2016-03-12 N/A CVE-2016-0819
Android — MediaTek The MediaTek Wi-Fi kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application, aka internal bug 26267358. 2016-03-12 N/A CVE-2016-0820
Android — Linux kernel The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialized list entry, aka Android internal bug 26186802, a different vulnerability than CVE-2015-3636. 2016-03-12 N/A CVE-2016-0821
Android — MediaTek The MediaTek connectivity kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application that leverages conn_launcher access, aka internal bug 25873324. 2016-03-12 N/A CVE-2016-0822
Android — Linux kernel The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721. 2016-03-12 N/A CVE-2016-0823
Android — Widevine The Widevine Trusted Application in Android 6.0.1 before 2016-03-01 allows attackers to obtain sensitive TrustZone secure-storage information by leveraging kernel access, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 20860039. 2016-03-12 N/A CVE-2016-0825
Android — mediaserver libcameraservice in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not require use of the ICameraService::dump method for a camera service dump, which allows attackers to gain privileges via a crafted application that directly dumps, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26265403. 2016-03-12 N/A CVE-2016-0826
Android — mediaserver Multiple integer overflows in libeffects in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allow attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, related to EffectBundle.cpp and EffectReverb.cpp, aka internal bug 26347509. 2016-03-12 N/A CVE-2016-0827
Android — mediaserver The BnGraphicBufferConsumer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not initialize a certain slot variable, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering an ATTACH_BUFFER action, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26338113. 2016-03-12 N/A CVE-2016-0828
Android — mediaserver The BnGraphicBufferProducer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not initialize a certain output data structure, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering a QUEUE_BUFFER action, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26338109. 2016-03-12 N/A CVE-2016-0829
Android — DTE Energy Insight application The REST API in the DTE Energy Insight application before 1.7.8 for Android allows remote authenticated users to obtain unspecified customer information via a SQL expression in the filter parameter. 2016-03-11 N/A CVE-2016-1562
Android — mediaserver libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792. 2016-03-12 N/A CVE-2016-1621
Android — libstagefright libmpeg2 in libstagefright in Android 6.x before 2016-03-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via crafted Bitstream data, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25765591. 2016-03-12 N/A CVE-2016-0824
Android — Bluetooth btif_config.c in Bluetooth in Android 6.x before 2016-03-01 allows remote attackers to cause a denial of service (memory corruption and persistent daemon crash) by triggering a large number of configuration entries, and consequently exceeding the maximum size of a configuration file, aka internal bug 26071376. 2016-03-12 N/A CVE-2016-0830
Android — Telephony The getDeviceIdForPhone function in internal/telephony/PhoneSubInfoController.java in Telephony in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not check for the READ_PHONE_STATE permission, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 25778215. 2016-03-12 N/A CVE-2016-0831
Android — Setup Wizard Setup Wizard in Android 5.1.x before LMY49H and 6.x before 2016-03-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25955042. 2016-03-12 N/A CVE-2016-0832
Apple — Apple Software Update Apple Software Update before 2.2 on Windows does not use HTTPS, which makes it easier for man-in-the-middle attackers to spoof updates by modifying the client-server data stream. 2016-03-13 N/A CVE-2016-1731
Cisco — HTTPS inspection engine The HTTPS inspection engine in the Content Security and Control Security Services Module (CSC-SSM) 6.6 before 6.6.1164.0 for Cisco ASA 5500 devices allows remote attackers to cause a denial of service (memory consumption or device reload) via a flood of HTTPS packets, aka Bug ID CSCue76147. 2016-03-09 N/A CVE-2016-1312
Cisco — administration interface The administration interface on Cisco DPC3939B and DPC3941 devices allows remote attackers to obtain sensitive information via a crafted HTTP request, aka Bug ID CSCus49506. 2016-03-09 N/A CVE-2016-1325
Cisco — administration interface The administration interface on Cisco DPQ3925 devices with firmware r1 allows remote attackers to cause a denial of service (device restart) via a crafted HTTP request, aka Bug ID CSCup48105. 2016-03-09 N/A CVE-2016-1326
Cisco — web server Buffer overflow in the web server on Cisco DPC2203 and EPC2203 devices with firmware r1_customer_image allows remote attackers to execute arbitrary code via a crafted HTTP request, aka Bug ID CSCuv05935. 2016-03-09 N/A CVE-2016-1327
Cisco — TelePresence Video Communication Server Cisco TelePresence Video Communication Server (VCS) X8.5.1 and X8.5.2 allows remote authenticated users to cause a denial of service (VoIP outage) via a crafted SIP message, aka Bug ID CSCuu43026. 2016-03-11 N/A CVE-2016-1338
Cisco — Prime LAN Management Solution Cisco Prime LAN Management Solution (LMS) through 4.2.5 uses the same database decryption key across different customers’ installations, which allows local users to obtain cleartext data by leveraging console connectivity, aka Bug ID CSCuw85390. 2016-03-11 N/A CVE-2016-1360
Cisco — IOS XR Cisco IOS XR through 4.3.2 on Gigabit Switch Router (GSR) 12000 devices does not properly check for a Bidirectional Forwarding Detection (BFD) header in a UDP packet, which allows remote attackers to cause a denial of service (line-card restart) via a crafted packet, aka Bug ID CSCuw56900. 2016-03-11 N/A CVE-2016-1361
Debian — jessie pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie lacks a namespace check associated with file-descriptor passing, which allows local users to capture keystrokes and spoof data, and possibly gain privileges, via pts read and write operations, related to debian/sysdeps/linux.mk. NOTE: this is not considered a vulnerability in the upstream GNU C Library because the upstream documentation has a clear security recommendation against the –enable-pt_chown option. 2016-03-13 N/A CVE-2016-2856
EMC — Documentum xCP EMC Documentum xCP 2.1 before patch 24 and 2.2 before patch 12 allows remote authenticated users to obtain sensitive user-account metadata via a members/xcp_member API call. 2016-03-09 N/A CVE-2016-0886
Google — Chrome The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly maintain the user agent shadow DOM, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage “type confusion.” 2016-03-13 N/A CVE-2016-1643
Google — Chrome WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly restrict relayout scheduling, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted HTML document. 2016-03-13 N/A CVE-2016-1644
Google — Chrome Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allow remote attackers to cause a denial of service (incorrect cast and out-of-bounds write) or possibly have unspecified other impact via crafted JPEG 2000 data. 2016-03-13 N/A CVE-2016-1645
IBM — Tivoli Monitoring The portal client in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 through FP6 allows remote authenticated users to gain privileges via unspecified vectors. 2016-03-11 N/A CVE-2015-7411
IBM — Flash System V9000 Cross-site request forgery (CSRF) vulnerability in IBM Flash System V9000 7.4 before 7.4.1.4, 7.5 before 7.5.1.3, and 7.6 before 7.6.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. 2016-03-12 N/A CVE-2015-7446
IBM — Maximo Asset Management IBM Maximo Asset Management 7.6 before 7.6.0.3 IFIX001 allows remote authenticated users to bypass intended access restrictions and read arbitrary purchase-order work logs via unspecified vectors. 2016-03-13 N/A CVE-2016-0222
IBM — Maximo Asset Management Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1.1 through 7.1.1.3, 7.5.0 before 7.5.0.9 IFIX004, and 7.6.0 before 7.6.0.3 IFIX001 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. 2016-03-13 N/A CVE-2016-0262
IBM — Maximo Asset Management SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX003, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX003, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. 2016-03-12 N/A CVE-2015-7448
IBM — WebSphere Commerce IBM WebSphere Commerce 6.x through 6.0.0.11, 7.x through 7.0.0.9, and 8.x before 8.0.0.3 allows remote attackers to cause a denial of service (order-processing outage) via unspecified vectors. 2016-03-13 N/A CVE-2016-0208
ISC — BIND named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c. 2016-03-09 N/A CVE-2016-1285
ISC — BIND named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c. 2016-03-09 N/A CVE-2016-1286
ISC — BIND resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option. 2016-03-09 N/A CVE-2016-2088
ISC — DHCP ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions. 2016-03-09 N/A CVE-2016-2774
microsoft — internet_explorer The CAttrArray object implementation in Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and memory corruption) via a malformed Cascading Style Sheets (CSS) token sequence in conjunction with modifications to HTML elements, aka “Internet Explorer Memory Corruption Vulnerability,” a different vulnerability than CVE-2015-6048 and CVE-2015-6049. 2016-03-09 N/A CVE-2015-6184
microsoft — windows Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 do not properly validate handles, which allows local users to gain privileges via a crafted application, aka “Windows Elevation of Privilege Vulnerability.” 2016-03-09 N/A CVE-2016-0087
microsoft — windows Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka “Library Loading Input Validation Remote Code Execution Vulnerability.” 2016-03-09 N/A CVE-2016-0100
microsoft — windows The USB Mass Storage Class driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows physically proximate attackers to execute arbitrary code by inserting a crafted USB device, aka “USB Mass Storage Elevation of Privilege Vulnerability.” 2016-03-09 N/A CVE-2016-0133
Mozilla — Firefox Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate. 2016-03-13 N/A CVE-2016-1950
Mozilla — Firefox Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. 2016-03-13 N/A CVE-2016-1952
Mozilla — Firefox Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to js/src/jit/arm/Assembler-arm.cpp, and unknown other vectors. 2016-03-13 N/A CVE-2016-1953
Mozilla — Firefox The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file. 2016-03-13 N/A CVE-2016-1954
Mozilla — Firefox Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element. 2016-03-13 N/A CVE-2016-1955
Mozilla — Firefox Mozilla Firefox before 45.0 on Linux, when an Intel video driver is used, allows remote attackers to cause a denial of service (memory consumption or stack memory corruption) by triggering use of a WebGL shader. 2016-03-13 N/A CVE-2016-1956
Mozilla — Firefox Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array. 2016-03-13 N/A CVE-2016-1957
Mozilla — Firefox browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL. 2016-03-13 N/A CVE-2016-1958
Mozilla — Firefox The ServiceWorkerManager class in Mozilla Firefox before 45.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via unspecified use of the Clients API. 2016-03-13 N/A CVE-2016-1959
Mozilla — Firefox Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545. 2016-03-13 N/A CVE-2016-1960
Mozilla — Firefox Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574. 2016-03-13 N/A CVE-2016-1961
Mozilla — Firefox Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections. 2016-03-13 N/A CVE-2016-1962
Mozilla — Firefox The FileReader class in Mozilla Firefox before 45.0 allows local users to gain privileges or cause a denial of service (memory corruption) by changing a file during a FileReader API read operation. 2016-03-13 N/A CVE-2016-1963
Mozilla — Firefox Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations. 2016-03-13 N/A CVE-2016-1964
Mozilla — Firefox Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property. 2016-03-13 N/A CVE-2016-1965
Mozilla — Firefox The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin. 2016-03-13 N/A CVE-2016-1966
Mozilla — Firefox Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls after restoring a browser session. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-7207. 2016-03-13 N/A CVE-2016-1967
Mozilla — Firefox Integer underflow in Brotli, as used in Mozilla Firefox before 45.0, allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted data with brotli compression. 2016-03-13 N/A CVE-2016-1968
Mozilla — Firefox The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font. 2016-03-13 N/A CVE-2016-1969
Mozilla — Firefox Integer underflow in the srtp_unprotect function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors. 2016-03-13 N/A CVE-2016-1970
Mozilla — Firefox The I420VideoFrame::CreateFrame function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows omits an unspecified status check, which might allow remote attackers to cause a denial of service (memory corruption) or possibly have other impact via unknown vectors. 2016-03-13 N/A CVE-2016-1971
Mozilla — Firefox Race condition in libvpx in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors. 2016-03-13 N/A CVE-2016-1972
Mozilla — Firefox Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors. 2016-03-13 N/A CVE-2016-1973
Mozilla — Firefox The nsScannerString::AppendUnicodeTo fynction in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document. 2016-03-13 N/A CVE-2016-1974
Mozilla — Firefox Multiple race conditions in dom/media/systemservices/CamerasChild.cpp in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors. 2016-03-13 N/A CVE-2016-1975
Mozilla — Firefox Use-after-free vulnerability in the DesktopDisplayDevice class in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. 2016-03-13 N/A CVE-2016-1976
Mozilla — Firefox The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted Graphite smart font. 2016-03-13 N/A CVE-2016-1977
Mozilla — Firefox Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption. 2016-03-13 N/A CVE-2016-1978
Mozilla — Firefox Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding. 2016-03-13 N/A CVE-2016-1979
Mozilla — Firefox The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font. 2016-03-13 N/A CVE-2016-2790
Mozilla — Firefox The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font. 2016-03-13 N/A CVE-2016-2791
Mozilla — Firefox The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800. 2016-03-13 N/A CVE-2016-2792
Mozilla — Firefox CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font. 2016-03-13 N/A CVE-2016-2793
Mozilla — Firefox The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font. 2016-03-13 N/A CVE-2016-2794
Mozilla — Firefox The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font. 2016-03-13 N/A CVE-2016-2795
Mozilla — Firefox Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font. 2016-03-13 N/A CVE-2016-2796
Mozilla — Firefox The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2801. 2016-03-13 N/A CVE-2016-2797
Mozilla — Firefox The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font. 2016-03-13 N/A CVE-2016-2798
Mozilla — Firefox Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font. 2016-03-13 N/A CVE-2016-2799
Mozilla — Firefox The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792. 2016-03-13 N/A CVE-2016-2800
Mozilla — Firefox The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2797. 2016-03-13 N/A CVE-2016-2801
Mozilla — Firefox The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font. 2016-03-13 N/A CVE-2016-2802
Samba — smbd The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content. 2016-03-13 N/A CVE-2015-7560
Samba — internal DNS server The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory by uploading a crafted DNS TXT record. 2016-03-13 N/A CVE-2016-0771
Schneider — Electric Telvent Sage Schneider Electric Telvent Sage 2300 RTUs with firmware before C3413-500-S01, and LANDAC II-2, Sage 1410, Sage 1430, Sage 1450, Sage 2400, and Sage 3030M RTUs with firmware before C3414-500-S02J2, allow remote attackers to obtain sensitive information from device memory by reading a padding field of an Ethernet packet. 2016-03-11 N/A CVE-2015-6485

 

Categories : English Articles,ICT and Computer Security Tags : , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Truffa sull’auto: attenzione alle bufale online

Inserito da 11 Marzo, 2016 (0) Commenti

Si tratta di :Curiosità,News

Si riporta un articolo pubblicato sul sito 6sicuro.it

“Bufale” e web, due facce della stessa medaglia. Se è innegabile come la rete ed i social permettano costantemente e in modo semplice l’accesso a news e notizie, è altrettanto vero che molto spesso queste notizie non sono veritiere. Puoi imbatterti in articoli e guide capaci di rispondere ai tuoi dubbi (6sicuro ne è esempio!), ma anche vere e proprie truffe, in grado di colpire gli utenti meno attenti.

La libertà di pubblicazione, se in molti casi è un inno alla libertà d’informazione, in altri diventa pericolo enorme. Ognuno è in grado di inventarsi questo o quel fatto e diffonderlo in modo rapido quanto inesorabile. Bastano poi poche persone disattente ed il gioco è fatto. La “bufala” like dopo like, condivisione dopo condivisione, diventa sempre più reale e la presunta truffa fa preoccupare.

Se spesso si tratta di invenzioni innocue, in molti casi diventano strumento enorme di manipolazione, con tutti i rischi che ne conseguono.

truffa-bufale-online

La truffa è sempre in agguato

Sono migliaia gli esempi che in questi anni hanno invaso le bacheche dei social e (purtroppo) di numerosi giornali online, anche loro caduti nel tranello. Molte di queste non fanno altro che puntare su elementi di forte discussione popolare, montandoli ad arte per generare interesse e, solitamente, polemica. Sono proprio questi passaggi, che giocano sulle certezze della gente, a dare credibilità alle notizie, tramutandole da incredibili a “normali”.

Un esempio recente è quello della monetina nella maniglia della portiera, metodo che secondo la “bufala” sarebbe utilizzato da presunti malfattori per rubare la borsa delle donne nei parcheggi dei supermercati o, peggio , come sistema per gabbare le chiusure centralizzate. Altra grande bufala è quella delle uova sul parabrezza che, se pulite con i tergicristalli, offuscheranno la visuale obbligando l’automobilista a fermarsi per essere derubato.

Una situazione a mente fredda poco plausibile certo, ma che facendo leva sulle paure del quotidiano e la diffusione web riesce a divenire quantomai credibile. Tanto credibile da essere addirittura riportata da alcune testate online.

Basterebbe una piccola ricerca web per comprendere la mancanza di casi reali in tal genere e, quindi, l’inesattezza della news, ma nella maggior parte dei casi questo passaggio non viene mai fatto.

Bufale: come riconoscerle ed evitarle?

Nel flusso continuo di notizie che ti bombardano non è semplice orientarsi, ma bastano poche, chiare regole per smascherarle:

  • Controllare la fonte: si parte da qui. Il “chi” in molti casi vale quanto il “cosa”. La fonte da cui deriva la notizia non è per questo mai secondaria, perché è proprio la reputazione e la serietà della stessa a fungere da garanzia di verità. Fonte che non significa solo il sito web che riporta la news, ma anche chi condivide. Molto più probabile credere al proprio dottore riguardo una news medica che all’amico solito a pubblicare solo foto delle proprie serate (con il massimo del rispetto);
  • Ricercare attraverso i motori di ricerca: a volte basta digitare qualche parola per venire a capo di situazioni dubbie. Cinque minuti e avrai conferma della bontà o meno della notizia letta;
  • Le “bufale” seguono le “mode” del momento. Per essere credibili e soprattutto generare passaparola, le “bufale” vengono costruite attorno ad argomenti fortemente esposti. Immigrati, carburanti alternativi, clausole assicurative, tecniche di furto, sono solo alcuni degli argomenti su cui vengono costruite migliaia di notizie fantasiose;
  • A volte ritornano: giocando su paure e manie popolari e quotidiane, non c’è da stupirsi che ogni truffa si riaffacci dopo mesi o anni di silenzio. Un circolo vizioso che in molti casi fa gioco (risentire spesso lo stesso fatto per molti è sinonimo di verità), ma che può sottolinearti l’infondatezza della news;
  • Usare la testa sempre e comunque. Basta ragionare con calma e a mente fredda per accorgersi che quel fatto che sembrava così plausibile in realtà non lo è così tanto;
  • Affidarsi alle forze dell’ordine: in casi davvero dubbi, meglio sempre chiedere a chi è più informato e soprattutto credibile. Non c’è nulla di cui vergognarsi, meglio una domanda in più, seppur banale. Farai del bene a te a chi ti sta vicino.

Conclusioni

Risate a parte (molte di queste “bufale” sono davvero comiche), i rischi riguardo le notizie false e le truffe online sono enormi, rischi che si tramutano in problemi reali per moltissimi utenti, che senza volerlo per una semplice disattenzione passano situazioni tutt’altro che semplici. Per questo il consiglio è di prestare sempre molta attenzione e non dare mai nulla per scontato. Anche un’innocua condivisione in Facebook può spesso nascondere mille insidie. Quindi occhi aperti e spirito critico sempre vigile.

Fonte: 6sicuro.it

Categories : Curiosità,News Tags : , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Abdul Zainal fa scoppiare una Bufala.. “Non mi hanno malmenato” l’ambulante di Termoli smentisce l’aggressione

Inserito da 27 Agosto, 2008 (0) Commenti

Si tratta di :Bufale e Hoax

L’ambulante smentisce l’aggressione è una bufala !

48b43b143d273_zoom

“Non sono stato né strattonato né malmenato dagli agenti di polizia municipale, e gli stessi non mi hanno messo di forza nel portabagagli dell’auto di servizio, anzi preciso che sono stato accompagnato negli uffici di polizia stando seduto sul sedile posteriore dell’auto di servizio. Non ho subito alcuna pressione o minaccia nel rendere questa dichiarazione e fin da adesso dichiaro di non adire per vie legali e tanto meno chiedere eventuali risarcimenti”.

È questa la dichiarazione resa, presso il comando di polizia municipale di Termoli, da Abdul Zainal, il cittadino del Bangladesh diventato protagonista di un fatto di cronaca subito smentito. Alcuni organi di informazione avevano infatti raccontato di una presunta “violenza” ai suoi danni nel corso di un’operazione di Polizia amministrativa condotta dai vigili urbani di Termoli.

La dichiarazione di Zainal conferma, dunque, quanto emerso ieri dopo i primi accertamenti, sollecitati dallo stesso sindaco di Termoli, Vincenzo Greco, che aveva chiesto al comando di polizia municipale di essere informato attraverso una relazione dettagliata circa l’accaduto. “Qualcuno ha preso un granchio a livello locale, che poi si è trasformato in bufala a livello nazionale”, ha commentato Greco, “C’è stata un’interpretazione distorta delle foto” ha aggiunto, riferendosi alle immagini pubblicate dal sito di informazione molisano Primo Numero. E a proposito dell’ambulante del Bangladesh sottoposto a controlli, il primo cittadino ha osservato: “La resistenza passiva degli extracomunitari non è casuale, fa parte di un bagaglio conoscitivo. Lui, peraltro, era senza titolo in Italia; ora, infatti, si pone la questione di procedere al fermo”.
Il sindaco ha voluto poi prendere le difese dei vigili urbani, “non sono razzisti né hanno mai avuto atteggiamenti violenti o discutibili nei confronti di stranieri o extracomunitari. Si tratta di vigili di consolidato mestiere”.

Il venditore ambulante non è quindi mai stato malmenato né chiuso nel bagagliaio dell’automobile di servizio della polizia municipale. L’uomo è scivolato sulla strada mentre cercava di fuggire dai controlli degli agenti. Alla richiesta di esibizione dei documenti, Zainal ha risposto di non averli con sé, e ha cominciato a urlare e chiedere aiuto. Numerose persone, che passeggiavano nel centro cittadino data la concomitanza con la tradizionale sagra del pesce, sono state attirate dalle urla del venditore ambulante, si sono avvicinate agli agenti di polizia municipale e hanno inveito contro di loro, prendendo le difese dell’uomo fermato, il quale ha continuato a opporre resistenza agli agenti, che stavano tentando di confiscare la sua merce.

Zainal è stato poi trasportato al comando per l’identificazione e il sequestro amministrativo della merce, visto che non era in possesso della licenza di vendita. L’uomo inoltre, è stato denunciato dai vigili urbani all’Autorità giudiziaria per resistenza a pubblico ufficiale.

Dai successivi accertamenti effettuati sono inoltre emersi altri particolari. Zainal è risultato essere pregiudicato per i seguenti reati: favoreggiamento di ingresso clandestino o irregolare, associazione per delinquere, estorsione. Dopo un periodo di reclusione di 18 mesi presso la casa circondariale di Cassino, nel settembre 2006 è stato scarcerato per gli effetti della legge sull’indulto. Contestualmente, il tribunale di Frosinone aveva emesso il decreto di espulsione.

fonte : Panorama

Categories : Bufale e Hoax Tags : , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Il truffatore cercando di accedere al nostro Bancopostaonline, ci mette in guardia dai malfattori e si rivolge a noi chiamandoci soci !!

Inserito da 26 Agosto, 2008 (0) Commenti

Si tratta di :Phishing e Truffe

Malfattore… e sito truffa

http://mariosalis.com/ js / i n dex.php utilizzando una falla 
presente in un advertising server di DoubleClick.
precisamente...
http://us.ebayobjects.com/2c;55707593;8701809;v?

di seguito il testo della e-mail fraudolenta, cestinare subito :

Benvenuto in BancoPostaonline!

Caro socio,

Verifica il tuo conto BancoPostaonline

Questa operazione e fondamentale per la sicurezza del Suo conto!

Recentemente abbiamo notato dei tentativi sospetti di accesso al Suo conto di PosteItaliane da un IP address straniero e noi abbiamo motivi di credere che la Sua carta prepagata sia stata utilizzata dai terzi senza la Sua autorizzazione.
Se recentemente ha copiuto dei viaggi all’estero e quindi ha utilizzato la sua carta prepagata PostePay, allora i tentativi insoliti di utilizzo potrebbero essere stati compiuti da lei. Se invece non sia stato cosi, La consigliamo di accedere tramite il seguente collegamento alla nostra base di dati e seguire le istruzioni, in modo da proteggerla da eventuali frode.

Contatta il seguente link:

link rimosso

per confermare il conto. Se scegliete di ignorare la nostra richiesta, purtroppo non avremo altra scelta che bloccare temporaneamente il Suo conto.

Se ha ricevuto questo avviso e non e il vero proprietario della carta prepagata di PosteItaliane, La informiamo che rappresenta una violazione della politica di PosteItaliane di sostituirsi ad un altro utente di PosteItaliane. Tale azione puo anche rappresentare una violazione di leggi locali, nazionali e/o internazionali. PosteItaliane si impegna nell’applicazione della legge nel tentativo di combattere le evetuali frodi o furti. Le informazioni saranno fornite su richiesta alle agenzie legali per accertarsi che i falsi possessori siano proseguiti nella misura adeguata dalla legge.

Grazie per la Sua collaborazione, e di aver accettato di lavorare insieme a noi per la sicurezza del Suo conto.

Distinti saluti,
PosteItaliane,Reparto Di Rassegna Di Cliente


Poste.it E-mail ID 52r229adf234vsa81385po2

Categories : Phishing e Truffe Tags : , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Phishing ai danni della Banca Ubi

Inserito da 26 Agosto, 2008 (0) Commenti

Si tratta di :Phishing e Truffe

ATTENZIONE FALSA EMAIL, TENTATIVO DI TRUFFA, CESTINARE ! :
SITO PHISHING : 19 4 .1 54.16 4. 10 0

Gentile cliente di Banca UBI,
Il Servizio Tecnico di Banca UBI Online sta eseguendo un aggiornamento programmato del software bancario al fine di migliorare la qualita dei servizi bancari.

Le chiediamo di avviare la procedura di conferma dei dati del Cliente. A questo scopo, La preghiamo di cliccare sul link che Lei trovera alla fine di questo messaggio.
Clicca qui per confermare

Ci scusiamo per ogni eventuale disturbo, e La ringraziamo per la collaborazione.
&copy Gruppo UBI Banca 2008

Categories : Phishing e Truffe Tags : , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Caro Membro CartaSi, CARTA SI SERVIZIO VERIFIED – TRUFFA, PHISHING AI DANNI CLIENTI TITOLARI CARTA SI, ONLINE BANKING

Inserito da 26 Agosto, 2008 (0) Commenti

Si tratta di :Phishing e Truffe

ATTENZIONE TRUFFA, NUOVO TENTATIVO PHISHING AI DANNI DEI CLIENTI CARTA SI

OGGETTO : Caro Membro CartaSi, CARTA SI SERVIZIO VERIFIED

SITO TRUFFA : http://www. mobeli nc.com/ medi a /s i.html

PRIMA COMUNICAZIONE INGANNEVOLE PROVENIENTE DA TERZI, PER IMPOSSESSARSI DEI VOSTRI CODICI DI ACCESSO AL CONTO…..

La sua iscrizione al servizio Verified by Visa e’ avvenuta con successo!
Le ricordiamo, da questo momento, di utilizzare la sua Password personale ogni volta che le verra’ richiesta: in caso contrario l’acquisto non potra’ concludersi.

Grazie ancora per aver scelto i servizi on-line di CartaSi.
I migliori saluti.

Servizio Clienti CartaSi

******************************

**********************************
VUOLE CONTESTARE SU UNA SPESA?

Easy Claim ? il servizio che fa per lei!

****************************************************************
IMPORTANTE! Se ha altre CartaSi deve iscriverle singolarmente al servizio

Inviato ai sensi del Provvedimento in materia di trasparenza delle operazioni e dei servizi finanziari emanato il 25 luglio dalla Banca d’Italia su delibera CICR del 04/04/2003.
****************************************************************

Per favore, non risponda a questa mail: per eventuali comunicazioni, acceda al Portale Titolari (https://titolari.cartasi.it) e ci scriva attraverso ‘Lo sportello del Cliente’: e’ il modo piu’ semplice per ottenere una rapida risposta dai nostri operatori.
Grazie della collaborazione.

Grazie ancora per aver scelto i servizi on-line di CartaSi.
I migliori saluti.

Servizio Clienti CartaSi

****************************************************************
VUOLE CONTESTARE SU UNA SPESA?

Easy Claim ? il servizio che fa per lei!

****************************************************************
IMPORTANTE! Se ha altre CartaSi deve iscriverle singolarmente al servizio

Inviato ai sensi del Provvedimento in materia di trasparenza delle operazioni e dei servizi finanziari emanato il 25 luglio dalla Banca d’Italia su delibera CICR del 04/04/2003.
****************************************************************

Per favore, non risponda a questa mail: per eventuali comunicazioni, acceda al Portale Titolari (https://titolari.cartasi.it) e ci scriva attraverso ‘Lo sportello del Cliente’: e’ il modo piu’ semplice per ottenere una rapida risposta dai nostri operatori.
Grazie della collaborazione.

SECONDA COMUNICAZIONE INGANNEVOLE PROVENIENTE DA TERZI, PER IMPOSSESSARSI DEI VOSTRI CODICI DI ACCESSO AL CONTO…..

Caro CartaSi cliente,
Abbiamo identificato da poco tempo che diversi computer si sono stati collegati al Suo conto Online Banking e sono stati presenti molteplici errori di parola prima del collegamento. Adesso e’ necessario che Lei ci riconfermi le informazioni del Suo presente conto.

Se non riceviamo le informazioni entro il 27 augosto , saremo costretti a sospendere il Suo conto per un periodo indefinito, come se fosse stato usato in scopi fraudolenti. La ringraziamo per la Sua cooperazione in questo problema.
Per confirmare i dati del Suo conto Online Banking cliccare sul seguente link:

https://titolari.cartasi.it/portal/server.pt

La ringraziamo per la Sua pazienza riguardando questo inconveniente.

Copyright © 2008 CartaSi S.p.A. – P.IVA 04107060966

Per assistenza tecnica: numero verde 803.160 (segui le istruzioni della guida vocale e scegli l’opzione Servizi Internet) .
Copyright © 2008 CartaSi S.p.A. – P.IVA 04107060966.

Categories : Phishing e Truffe Tags : , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Quando le strategie di marketing, diventano una forzatura per lPhone file fantasma in Polonia

Inserito da 25 Agosto, 2008 (0) Commenti

Si tratta di :News

mah.. che dire questo iphone in Polonia… veramente non è un oggetto del desisderio, era proprio necessario pagare le persone per fare una fila finta ? siamo nella società commerciale e ormai non ci meravigliamo di nulla che mondo….

La società di telefonia Orange ha reclutato diverse comparse per creare lunghe file davanti ai negozi il giorno di lancio dell’iPhone in Polonia

L’obiettivo di Apple è dichiarato: 10 milioni di iPhone venduti entro la fine del 2008. Un traguardo apparentemente difficile da raggiungere, ma un po’ per la grancassa che si è fatta negli ultimi mesi, un po’ per alcuni “stratagemmi” studiati per convincere gli indecisi, l’obiettivo comincia a sembrare alla portata della società di Steve Jobs.

Se negli Stati Uniti, infatti, si sono venduti oltre 1 milione di iPhone solo nella prima settimana dopo il lancio, nel resto del mondo non si è rimasti a guardare, e il superfonino di Apple si vende alla stregua del pane, anche se con prezzi decisamente superiori e con qualche difettuccio che continua a guastare la festa ai felici possessori dell’iPhone.

Ma quello che sorridere sono gli espedienti che qualche società di telefonia mobile ha messo in campo per cercare di sfruttare la popolarità dell’iPhone e cavalcare l’onda della “mania collettiva”. In Polonia, per esempio, la Orange, uno degli operatori mobili che in quel Paese equipaggeranno l’iPhone, ha reclutato e stipendiato qualche decina di giovani per fare in modo che si allineassero in fila davanti ai negozi, il giorno di lancio dell’iPhone in Polonia. Tutto questo per ricreare l’atmosfera di frenetica attesa e desiderio incontrollato che si è vista in molti Paesi nel mondo, pur sapendo che per la Polonia l’iPhone è un prodotto di lusso, visto il prezzo del telefonino e degli abbonamenti abbinati.

Ma la creatività dei “commercianti” non ha mai fine, e in Polonia, al momento dell’ora X, sono comparse magicamente file di ragazzi dotati di zaini e seggiolini portatili che si sono messi in fila davanti ai negozi, il tutto per scatenare la curiosità dei passanti e far crescere l’attenzione sull’iPhone.

Una mossa che la stessa Orange ha ammesso senza problemi, beneficiando alla fine di un battage pubblicitario che difficilmente avrebbero potuto innescare con una campagna promozionale tradizionale. Su quanti iPhone, poi, si venderanno in Polonia, ci vorrà ancora un po’ per capirlo. Nel frattempo, la marcia di avvicinamento ai 10 milioni di iPhone venduti continua inarrestabile. Anche grazie a questi piccoli sotterfugi.

fonte : Pcworld

Categories : News Tags : , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Attenzione ! Antivirus XP 2008

Inserito da 23 Agosto, 2008 (0) Commenti

Si tratta di :Bufale e Hoax

Antivirus XP 2008 non è un antivirus. E’ uno dei più devastanti malware che si possono trovare in circolazione. La sua installazione viene generalmente veicolata quando l’utente del pc desidera installare particolari codec per la visualizzazione di file video. Il programma si attiva automaticamente rilevando un numero abnorme di virus che “sarebbero” installati sul computer e invita a visitare il sito del produttore per pagare la licenza completa. Ovviamente vi invitiamo a non farlo: prima di tutto perchè Antivirus XP 2008 non è assolutamente un antivirus anzi è un virus lo stesso programma e quindi non rimuoverà un bel niente. In secondo luogo perchè è molto probabile che i dati di carta di credito che vi verrebbero richiesti per l’acquisto sarebbero trattati da sistemi poco sicuri (per utilizzare un eufemismo).

Nonostante l’utente cerchi di disinstallare il programma quest’ultimo continua ad attivarsi eseguendo la sua presunta scansione.

L’unico modo per procedere alla disinstallazione di Antivirus XP 2008 è quello di operare manualmente:

  • Utilizzando Task Manager interrompere i seguenti processi :XPAntivirus.exe
    XPAntivirusUpdate.exe
  • Utilizzando regedit rimuovere le seguenti chiavi di sistema :HKEY_USERSSoftwareMicrosoftWindowsCurrentVersionRun”XP antivirus” = “C:Program FilesXPAntivirusXPAntivirus.exe”
    HKEY_USERSSoftwareMicrosoftWindowsCurrentVersionRun”XPAntivirus” = “C:Program FilesXPAntivirusXPAntivirus.exe”
    HKEY_USERSSoftwareXP antivirus
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallXP antivirus_is1
    HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesXPAntivirusFilter
  • Rimuovere la registrazione delle seguenti DLL :shlwapi.dll
    wininet.dll
  • Individuare e cancellare i seguenti file :XPAntivirus.exe
    XPAntivirus.url
    XPAntivirusUpdate.exe
    XPAntivirus_log.txt
    XPAntivirus.lnk
    Desktop\XPAntivirus.lnk
    Uninstall XPAntivirus.lnk
    XPAntivirus on the Web.lnk
    XPAntivirus.lnk
    backup.lst helper.sys
    pn.cfg
    spyware.dat
    explorer.exe
    explorer.exe.md5
    ntoskrnl.exe
    ntoskrnl.exe.md5
    shlwapi.dll
    shlwapi.dll.md5
    wininet.dll
    wininet.dll.md5
    unins000.dat
    unins000.exe
    ver.dat
    whitelist.cfg

Riavviare il computer.

FONTE AVG

Categories : Bufale e Hoax Tags : , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

AVG Segnalato falso positivo in file aaaamon.dll

Inserito da 23 Agosto, 2008 (0) Commenti

Si tratta di :Sicurezza
ATTENZIONE NON SI TRATTA DI UN VIRUS E’ UN FALSO POSITIVO
Il problema descritto in questo articolo è stato risolto il 21.08.2008, con il rilascio del database di impronte virali 270.6.6/1625.
Aggiornate il vostro AVG

Data : 20/08/2008
Infezione : Trojan Horse Patched_c.yl
File : aaaamon.dll
Versione AVG : 8.0.164
Versione Db : 270.6.6/1621

Situazione : FALSO POSITIVO

Gli utenti di Windows 2000 e Windows XP (SP2 e SP3) che utilizzano AVG 8.0 aggiornato ai rilasci dettagliati sopra possono verificare la rilevazione di un Trojan all’interno del file aaaamon.dll. Si tratta di un falso positivo: il file aaaamon.dll è un componente legittimo di sistema di Windows utilizzato per ottimizzare la gestione delle risorse ram e cpu del computer.

Per evitare la continua rilevazione del file infetto è possibile procedere come segue :

  • Inserire il file nell’elenco delle eccezioni di Resident Shield. Oppure …
  • Cliccare su ignora all’apertura della finestra di dialogo che avvisa dell’avvenuta rilevazione. Oppure …
  • Spostare il file in quarantena. Nonostante Windows possa funzionare correttamente senza questo file apparirà una finestra di dialogo che chiede il ripristino del file: cliccare su annulla e quindi accettare che Windows rimanga con una versione non verificata del file. Alla ricezione del prossimo aggiornamento da parte di AVG, accedere all’area di quarantena e ripristinare il file.

Attenzione ! Questo articolo si riferisce solo all’infezione Trojan Horse Patched_c.yl rilevata nel file %windir%system32aaaamon.dll oppure nella directory DLLCache del sistema operativo. Ogni altro tipo di infezione rilevata, sebbene sullo stesso file, non è da considerarsi un falso positivo.

Per coloro che hanno messo il file in quarantena e successivamente hanno svuotato l’area di quarantena è possibile scaricare la libreria direttamente da download aaaamon.dll.

FONTE: AVG

Categories : Sicurezza Tags : , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Vulnerabilita’ multiple in Opera Web Browser

Inserito da 22 Agosto, 2008 (0) Commenti

Si tratta di :Exploits,Sicurezza

Descrizione del problema

Sono state segnalate varie vulnerabilita’ presenti nel browser web Opera, che potrebbero essere sfruttate per aggirare restrizioni di sicurezza, ottenere accesso a informazioni riservate, o prendere il controllo di un sistema affetto.

La prima vulnerabilita’ e’ causata da un errore che si verifica se il browser viene aperto da un’altra applicazione quando e’ stato registrato come gestore di uno specifico protocollo, e puo’ essere sfruttata per causare un blocco del sistema o per eseguire codice arbitrario.

La seconda vulnerabilita’ e’ dovuta ad un errore nel modo in cui il browser controlla quali frame vanno cambiati, e puo’ essere sfruttata da un sito appositamente predisposto, per cambiare l’indirizzo di frame che puntano ad altri siti all’interno di ogni finestra di browser aperta, e mostrare informazioni ingannevoli.

La terza vulnerabilita’ e’ causata da un errore non specificato nella validazione dell’input, che potrebbe permettere cross-site scripting.

La quarta vulnerabilita’ e’ causata da un errore nel gestire parametri malformati in congiunzione con scorciatoie di tastiera personalizzate e comandi di menu, e puo’ essere sfruttata per eseguire codice arbitrario.

La quinta vulnerabilita’ e’ dovuta al fatto che il browser mostra scorrettamente l’icona di padlock quando pagine non sicure caricano contenuti sicuri all’interno di un frame, e puo’ essere sfruttata inducendo la finestra di dialogo di security information a considerare la connessione sicura.

La sesta vulnerabilita’ e’ causata da un errore nell’iscriversi a news feed usando il bottone di iscrizione ai feed, e puo’ essere sfruttata per cambiare l’indirizzo della pagina.
:: Software interessato

Opera versione 9.51 e precedenti
:: Impatto

Bypass dei controlli di sicurezza
Esposizione di informazioni sensibili
Spoofing di indirizzi
Denial of Service
Accesso al sistema
:: Soluzione

Aggiornare Opera alla versione 9.52
http://www.opera.com/download/
:: Riferimenti

Opera
http://www.opera.com/docs/changelogs/windows/952/

http://www.opera.com/support/search/view/892/
http://www.opera.com/support/search/view/893/
http://www.opera.com/support/search/view/894/
http://www.opera.com/support/search/view/895/
http://www.opera.com/support/search/view/896/
http://www.opera.com/support/search/view/897/

Securityfocus Bugtraq ID
http://www.securityfocus.com/bid/30768

Secunia
http://secunia.com/advisories/31549

FrSirt
http://www.frsirt.com/english/advisories/2008/2416

Categories : Exploits,Sicurezza Tags : , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,