Multiple vulnerabilities have been reported in cPanel, which can be exploited by malicious, local users to gain escalated privileges, by malicious users to compromise a vulnerable system, and by malicious people to conduct brute force attacks.

1) An error in the usage of the "Storable" module can be exploited by local users to inject code into serialized structures.

2) An error in the usage of the "YAML::Syck" module can be exploited by local users to bless serialized data into arbitrary packages, which may result in unsafe actions being performed within object destructors.

3) An error exists in the "Locale::Maketext" module.

For more information:
SA51498

4) An error exists in the "Crypt::Passwd::XS" module when using the DES crypt algorithm.

For more information:
SA49304

5) An error in the "Cpanel::Locale" module when performing date formatting can be exploited to inject arbitrary shell commands.

Successful exploitation of vulnerabilities #3 and #5 may allow execution of arbitrary code.

The vulnerabilities are reported in versions prior to 11.30.7.4, 11.32.5.15, and 11.34.0.11.

Solution
Update to version 11.30.7.4, 11.32.5.15, or 11.34.0.11.

Provided and/or discovered by
Development and Quality Assurance teams, cPanel.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://cpanel.net/important-11-30-11-32-11-34-cpanel-whm-updates-available/

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers