Core Security Technologies Advisory - SAP distributes software and packages using an archive program called SAPCAR. This program uses a custom archive file format. A memory corruption vulnerability was found in the parsing of specially crafted archive files, that could lead to local code execution scenarios. Version 721.510 is affected.
a3d3c8ab85600ad227bf0c9e7815c6b6891b9a726516893c8a904650f83bd791Dolibarr version 4.0.4 suffers from cross site scripting, weak hashing, weak password change, and remote SQL injection vulnerabilities.
67e466b14aa97ac21950629117eb4c52ee558b2a3430fa6644da1913cbe9299eSide channel attacks against cryptographic systems involve identifying ways in which their physical implementations leak useful information. A cryptographic algorithm may be secure on paper but when implemented on physical hardware some of the secret data, such as key bits, may potentially be recovered by an attacker by measuring various physical properties whilst encryption or decryption is being performed. This essay reviews the most successful countermeasures that can be used to make different classes of side channel attacks as difficult as possible. An understanding of basic principles of cryptography is assumed.
291a3d1be421c2c85288ddda1845bef8abe134544fe137f42cec5bfcdd6661a4ASUS routers suffer from cross site request forgery and information disclosure vulnerabilities. Versions affected include RT-AC55U, RT-AC56R, RT-AC56S, RT-AC56U, RT-AC66U, RT-AC88U, RT-AC66R, RT-AC66U, RT-AC66W, RT-AC68W, RT-AC68P, RT-AC68R, RT-AC68U, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC53U, RT-AC1900P, RT-AC3100, RT-AC3200, RT-AC5300, RT-N11P, RT-N12 (D1 version only), RT-N12+, RT-N12E, RT-N18U, RT-N56U, RT-N66R, RT-N66U (B1 version only), and RT-N66W.
c234e4d0097a292327004469b2284cab90e82e534ca260fba018cd3bf48a7f3cSMBv1 SrvOs2FeaToNt OOB is prone to a remote code execution vulnerability because the application fails to perform adequate boundary-checks on user-supplied input. This exploit leverages this vulnerability as described in MS17-010.
a8aa061521a024a2681c43faf9e0f6857ab4aabefda62ecf82da7a024aea3165Microsoft OneDrive iOS App version 8.13 suffers from insecure handling of URI schemes.
96331267202453f8bfd241fa5ca12ebd55aa736445faad81735248a4b2b85409Apache Cordova Android versions 5.2.2 and below suffer from an internal system information leak.
6d19a43b5483e62b92528c2faf17a5b1fc33d7214f66d7e7ceca23a6b2c3bfd2This bulletin summary lists 65 critical and 9 important security updates in May, 2017.
29fa485905d0e964fdda0ff2a99ad7bd6074bdef64b59a4fbf3bd355598a59a5Red Hat Security Advisory 2017-1206-01 - Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm package provides the user-space component for running virtual machines that use KVM. Security Fix: A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.
b02b7173440f427f717685ada5dc95c4b660786f94efef1453ce77af5eac1c51Red Hat Security Advisory 2017-1205-01 - KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. Security Fix: A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.
402bb60cbd271f30307359df59a64ca74bc2ac977bcc7313118c66cbb1746a97Red Hat Security Advisory 2017-1218-01 - Red Hat JBoss BPM Suite is a business rules and processes management system for the management, storage, creation, modification, and deployment of JBoss rules and BPMN2-compliant business processes. This release of Red Hat JBoss BPM Suite 6.4.3 serves as a replacement for Red Hat JBoss BPM Suite 6.4.2, and includes bug fixes and enhancements.
cff127c367e1d9f07b839da483ccc990572a78972f8acfe89e50b9742aa1e162Red Hat Security Advisory 2017-1217-01 - Red Hat JBoss BRMS is a business rules management system for the management, storage, creation, modification, and deployment of JBoss Rules. This release of Red Hat JBoss BRMS 6.4.3 serves as a replacement for Red Hat JBoss BRMS 6.4.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix: JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote, authenticated attackers that have privileges to create lists can store scripts in them, which are not properly sanitized before showing to other users, including admins.
37af96bbce8aa2373781f64ac81ae8fba02650437693f617e2e04efa4216c603Red Hat Security Advisory 2017-1216-01 - IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 7 to version 7R1 SR4-FP1. Security Fix: This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit.
84dd0e9308948c7a415adab659e14d620e0b251a8ae7e925fb16b9d7d3d57359Red Hat Security Advisory 2017-1209-01 - The rhev-hypervisor package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Security Fix: A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol implementation freed SKB resources for a DCCP_PKT_REQUEST packet when the IPV6_RECVPKTINFO option is set on the socket. A local, unprivileged user could use this flaw to alter the kernel memory, allowing them to escalate their privileges on the system.
2f16680716ad6b5f3fd9b91582d4e0d857c960d828bb14bce374dcbc21b0cbf1Red Hat Security Advisory 2017-1220-01 - IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 8 to version 8 SR4-FP5. Security Fix: This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit.
093434611ec59119366abea5905399c4e5d1951e04db5c774902cad99f0c8748Red Hat Security Advisory 2017-1221-01 - IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 7 to version 7R1 SR4-FP5. Security Fix: This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit.
d31a1f3f9663cabb8c237233a9de29b2d5c0712ffe13e391fa754587ba4a28c9Red Hat Security Advisory 2017-1222-01 - IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 6 to version 6 SR16-FP45. Security Fix: This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit.
27e1ec4c169d95aad8170c48e9f29e62fed856fda2cf35a34bbd58810fd27febDebian Linux Security Advisory 3848-1 - Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted login shell for Git-only SSH access, allows a user to run an interactive pager by causing it to spawn "git upload-pack --help".
d5f4d0dbda23cd7fe43f7014ea89b1af9edd308f0898afd4ecd6d344ec21d543Ubuntu Security Notice 3283-1 - Dave McDaniel discovered that rtmpdump incorrectly handled certain malformed streams. If a user were tricked into processing a specially crafted stream, a remote attacker could cause rtmpdump to crash, resulting in a denial of service, or possibly execute arbitrary code.
13d52bf2c2e32ad2dfb653a2395a3fa6099672a82c8c915815b0de2533e2fc8eDebian Linux Security Advisory 3847-1 - Jan Beulich and Jann Horn discovered multiple vulnerabilities in the Xen hypervisor, which may lead to privilege escalation, guest-to-host breakout, denial of service or information leaks.
ef39c1de6d0ec5018cfe4cea5d3d68ce3dd8f308f08223198e250746818448e3HPE Security Bulletin HPESBST03739 1 - A potential security vulnerability with Brocade Fabric OS (FOS) has been addressed in HPE StoreFabric B-series Switches. The vulnerability could be remotely exploited to allow an authenticated attacker to elevate the privileges of user accounts. Revision 1 of this advisory.
2e1f5bfed0e3930e58642e19199648ca36ef536663f558ec1eaefc853e74459fRed Hat Security Advisory 2017-1219-01 - The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 25.0.0.171. Security Fix: This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content.
53ae1e257a4ca37b01620988805dd0abd58622b017a285879d5e563ba770f0d1Gentoo Linux Security Advisory 201705-8 - Multiple vulnerabilities have been found in libav, the worst of which may allow execution of arbitrary code. Versions less than 11.8 are affected.
66d25d00a1abbc2cdd8a675bbfd3581b789314e3a5329b638213870cf197f768Gentoo Linux Security Advisory 201705-7 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. Versions less than 45.8.0 are affected.
93159ecbb12bbc05425aef215d67626d9e4093241fba87c387238cb78823b3aeGentoo Linux Security Advisory 201705-6 - Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. Versions less than 45.8.0 are affected.
5c6278b966f1faccd5cb8c0f3e153671aa8023269f93b652fd1be783ab33112b
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed