Ike.ninja

Bash CVE-2014-6217 and CVE-2014-7169 CVE-2014-6217 is a critical vulnerability in all versions of GNU Bash, the Bourne Again Shell.This vulnerability allows an attacker to execute arbitrary shell commands any time a Bash shell executes with environmental variables supplied by the attacker. On cPanel & WHM systems, there are numerous entry …

SUMMARY cPanel, Inc. has released EasyApache 3.26.3 with PHP version 5.5.15, Libxslt version 1.1.28 and Libxml2 version 2.9.1. This release addresses PHP vulnerability CVE-2014-4670 by fixing a bug in the SPL component, CVE-2012-6139 by fixing a bug in Libxslt, and fixes bugs in Libxml2 to address the following CVEs: CVE-2012-5134, …

SUMMARY cPanel, Inc. has released EasyApache 3.24.22 with PHP 5.4.30 and 5.5.14. This release addresses multiple PHP vulnerabilities in the PHP core code and the Fileinfo, Network, and SPL modules. We encourage all PHP users to upgrade to PHP 5.4.30 and PHP 5.5.14. AFFECTED VERSIONS All versions of PHP 5.4 …

SUMMARY cPanel, Inc. has released EasyApache 3.24.18 with PHP versions 5.5.12 and 5.4.28. This release addresses the PHP vulnerability CVE-2014-0185 with the fix to a bug in the FPM package. We encourage all PHP users to upgrade to PHP version 5.5.12 or PHP version 5.4.28. AFFECTED VERSIONS All versions of …

SUMMARY cPanel, Inc. has released EasyApache 3.24.15 with FCGI version 2.3.9 and PHP versions 5.5.10 and 5.4.27. This release addresses the FCGI vulnerability CVE-2013-4365 with fixes to a possible heap buffer overwrite issue, and the PHP vulnerability CVE-2013-7345 with fixes to bugs in the fileinfo module. We encourage all FCGI …

SUMMARY cPanel, Inc. has released EasyApache 3.24.13 with Apache version 2.4.9. This release addresses Apache vulnerabilities CVE-2014-0098 and CVE-2013-6438, by fixing bugs in the mod_log_config and mod_dav modules. We encourage all Apache users to upgrade to Apache version 2.4.9. AFFECTED VERSIONS All versions of Apache version 2.4 before 2.4.9. SECURITY …

(Feb 16) Several vulnerabilities have been discovered in the chromium web browser. CVE-2013-6641 [More…]

(Jan 23) A regression has been found on the denyhosts packages fixing CVE-2013-6890. This regression could cause an attempted breakin attempt to be missed by denyhosts, which would then fail to enforce a ban. [More…]

(Jan 17) Multiple security issues have been found in Libvirt, a virtualisation abstraction library: CVE-2013-6458 [More…]

(Dec 9) Two security issues were found in Samba, a SMB/CIFS file, print, and login server: CVE-2013-4408 [More…]

(Dec 3) Several vulnerabilities have been discovered in OpenJPEG, a JPEG 2000 image library, that may lead to denial of service (CVE-2013-1447) via application crash or high memory consumption, possible code execution through heap buffer overflows (CVE-2013-6045), information disclosure [More…]

The following features were added:

[+] (Windows) BIND DNS server was updated to version 9.9.4-P1, CVE-2013-6230 vulnerability is closed.
[+] (Windows) Horde webmail was updated to version 5.1.5, CVE-2013-6275 vulnerability is closed.

The following issues were resolved:

[-] The piped logging feature did not write access_logs for add-on domains and subdomains.
[-] Plesk could not register PHP handlers because of wrong directives in php.ini or if running php -v returned exit code 1. (PPPM-808, PPPM-885)
[-] Chained SSL certificates no longer worked with nginx after upgrade.
[-] During upgrade to Plesk 11.5, the directories of add-on domains were incorrectly relocated in the new structure of virtual hosts.

(Nov 13) Several vulnerabilities have been discovered in the lighttpd web server. CVE-2013-4508 [More…]

(Oct 24) The update of librack-ruby in DSA-2783-1 also addressed CVE-2013-0183. The patch applied breaks rails applications like redmine (see Debian Bug #727187). Updated packages are available to address this problem. [More…]

(Aug 31) Two vulnerabilities were discovered in Cacti, a web interface for graphing of monitoring systems: CVE-2013-5588 [More…]