SUSE SLES12 Security Update : qemu (SUSE-SU-2018:1363-1) (Spectre)

This update for qemu fixes several issues. This security issue was fixed : - CVE-2018-3639: Spectre v4 vulnerability mitigation support for KVM guests bsc1092885. Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all pri...

PT-2018-16076

Name of the Vulnerable Software and Affected Versions Qualcomm Android for MSM versions prior to security patch level 2018-04-05 Firefox OS for MSM versions prior to security patch level 2018-04-05 QRD Android versions prior to security patch level 2018-04-05 Description A Use After Free conditio...

kernel security and bug fix update

2.6.32-696.20.1.OL6 - Update genkey bug 25599697 2.6.32-696.20.1 - x86 kaiser/efi: unbreak tboot Waiman Long 1519799 1519802 CVE-2017-5754 - x86 pti/mm: Fix trampoline stack problem with XEN PV Waiman Long 1519799 1519802 CVE-2017-5754 - x86 pti/mm: Fix XEN PV boot failure Waiman Long 1519799...

PT-2017-3644

Name of the Vulnerable Software and Affected Versions: Android versions 7.0 through 8.1 Description: The issue is related to a missing bounds check in the avrc ctrl pars vendor rsp function of the Bluetooth AVRCtrl, which could lead to an out of bounds write on the stack. This could result in...

PT-2017-18310

Name of the Vulnerable Software and Affected Versions STDU Viewer version 1.6.375 Description The issue might allow user-assisted attackers to execute code via a crafted file. A possible threat scenario involves a victim obtaining an untrusted crafted file from a remote location and issuing sever...

CVE-2017-8387: Improper Restriction of Operations within the Bounds of a Memory Buffer

STDU Viewer version 1.6.375 might allow user-assisted attackers to execute code via a crafted file. One threat model is a victim who obtains an untrusted crafted file from a remote location and issues several user-defined commands including Ctrl-+ commands...

DEBIAN-CVE-2015-8613

Stack-based buffer overflow in the megasasctrlgetinfo function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service QEMU instance crash via a crafted SCSI controller CTRLGETINFO command...

openssh security and bug fix update

5.3p1-122 - Allow to use ibmca crypto hardware 1397547 - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes 1405374 5.3p1-121 - Fix missing hmac-md5-96 from server offer 1373836 5.3p1-120 - Prevent infinite loop when Ctrl+Z pressed at password prompt 1218424 - Remove...

PT-2023-1383

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.9.176 Description The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib prctl set function updates the Thread Information Flags TIFs for the task and...

CVE-2017-6561

XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=object&action=XSS attack...

CVE-2017-6560: Improper Neutralization of Input During Web Page Generation

XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=misc&action=XSS&editObjId=XSS attack...

PT-2017-17160

Name of the Vulnerable Software and Affected Versions Agora-Project version 3.2.2 Description The issue is related to a cross-site scripting XSS attack. It affects the index.php file, specifically when the ctrl parameter is set to 'file', the targetObjId parameter is set to 'fileFolder-2', and th...

PT-2017-17158

Name of the Vulnerable Software and Affected Versions Agora-Project version 3.2.2 Description The issue is related to a cross-site scripting XSS attack. The attack can be performed using the "index.php?ctrl=misc&action=XSS&editObjId=XSS" endpoint, where action and editObjId are vulnerable...

UBUNTU-CVE-2016-9801

In BlueZ 5.42, a buffer overflow was observed in "setextctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file...

PT-2016-7829

Name of the Vulnerable Software and Affected Versions BlueZ version 5.42 Description A buffer overflow issue was found in the set ext ctrl function located in the tools/parser/l2cap.c source file when handling a corrupted dump file. Recommendations For BlueZ version 5.42, as a temporary workaroun...

PT-2016-6373

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description The issue allows local guest OS administrators to obtain sensitive host memory information. This is achieved through vectors related to reading device control information in the megasas ctrl get...

PT-2015-7716

Name of the Vulnerable Software and Affected Versions Samsung SmartViewer affected versions not specified Description The issue concerns the rtsp getdlsendtime method in the CNC Ctrl control of Samsung SmartViewer, which allows remote attackers to execute arbitrary code via an index value. This c...

OracleVM 3.3 : sudo (OVMSA-2015-0103)

The remote OracleVM system is missing necessary patches to address critical security updates : - RHEL-6.7 erratum - modified the authlogicfix patch to fix 1144448 - fixed a bug in the ldapusermatchfix patch Resolves: rhbz1144448 Resolves: rhbz1142122 - RHEL-6.7 erratum - fixed the...

SUSE SLED12 / SLES12 Security Update : tigervnc (SUSE-SU-2014:1592-1)

This update for tigervnc provides the following fixes : - Fixed integer overflow flaw, leading to a heap-based buffer overflow in screen size handling. CVE-2014-8240 - Send correctly keys that don't type any characters, such as CTRL+Space. bnc906922 Note that Tenable Network Security has extracte...

PT-2014-8912

Name of the Vulnerable Software and Affected Versions Samsung SmartViewer affected versions not specified Description The issue is related to a stack-based buffer overflow in the BackupToAvi method of the CNC Ctrl ActiveX control. This allows remote attackers to execute arbitrary code via...