UEFI EDK2 Capsule Update Vulnerabilities

Lenovo Security Advisory: LEN-2014-001 Potential Impact: Execution of arbitrary code Severity: Medium Summary: The EDK2 UEFI reference implementation contains multiple vulnerabilities in the Capsule Update mechanism. Description: The open source EDK2 project provides a reference implementation of...

openSUSE Security Update : ImageMagick (openSUSE-2016-883)

ImageMagick was updated to fix 66 security issues. These security issues were fixed : - CVE-2014-9810: SEGV in dpx file handler. bsc983803. - CVE-2014-9811: Crash in xwd file handler bsc984032. - CVE-2014-9812: NULL pointer dereference in ps file handling bsc984137. - CVE-2014-9813: Crash on...

Moodle 2.4.x < 2.4.8 / 2.5.x < 2.5.4 / 2.6.x < 2.6.1 Multiple Vulnerabilities

Binary data 9420.prm...

Security update for ImageMagick (important)

ImageMagick was updated to fix 66 security issues. These security issues were fixed: - CVE-2014-9810: SEGV in dpx file handler. bsc983803. - CVE-2014-9811: Crash in xwd file handler bsc984032. - CVE-2014-9812: NULL pointer dereference in ps file handling bsc984137. - CVE-2014-9813: Crash on...

F5 Networks BIG-IP : NTP vulnerability (SOL15935)

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Fedora 23 : xen (2016-8d3fe9914b)

cleaner way to set kernel module load list Unrestricted qemu logging XSA-180, CVE-2014-3672 1339125 Qemu: scsi: esp: OOB write while writing to 's-cmdbuf' in espregwrite CVE-2016-4439 1337502 Qemu: scsi: esp: OOB write while writing to 's-cmdbuf' in getcmd CVE-2016-4441 1337505 Qemu: scsi: megasa...

Fedora 22 : xen (2016-4edd58a3b5)

cleaner way to set kernel module load list Unrestricted qemu logging XSA-180, CVE-2014-3672 1339125 Qemu: scsi: esp: OOB write while writing to 's-cmdbuf' in espregwrite CVE-2016-4439 1337502 Qemu: scsi: esp: OOB write while writing to 's-cmdbuf' in getcmd CVE-2016-4441 1337505 Qemu: scsi: megasa...

PHP < 5.4.45, 5.5.x < 5.5.29, 5.6.x < 5.6.13 Multiple Vulnerabilities (Jul 2016) - Linux

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

Fedora 24 : xen (2016-cfea37952b)

cleaner way to set kernel module load list Unrestricted qemu logging XSA-180, CVE-2014-3672 1339125 Qemu: scsi: esp: OOB write while writing to 's-cmdbuf' in espregwrite CVE-2016-4439 1337502 Qemu: scsi: esp: OOB write while writing to 's-cmdbuf' in getcmd CVE-2016-4441 1337505 Qemu: scsi: megasa...

openSUSE Security Update : the Linux Kernel (openSUSE-2016-862)

====================================================================== The openSUSE 13.1 kernel was updated to 3.12.59 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2016-4997: A buffer overflow in 32bit compatsetsockopt iptables handling could lead to a...

CVE-2014-9797

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0974. Reason: This candidate is a reservation duplicate of CVE-2014-0974. Notes: All CVE users should reference CVE-2014-0974 instead of this candidate. All references and descriptions in this candidate have been removed to...

CVE-2014-9794

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0973. Reason: This candidate is a reservation duplicate of CVE-2014-0973. Notes: All CVE users should reference CVE-2014-0973 instead of this candidate. All references and descriptions in this candidate have been removed to...

CVE-2014-9793

platform/msmshared/mmc.c in the Qualcomm components in Android before 2016-07-05 on Nexus 7 2013 devices mishandles the power-on write-protect feature, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28821253 and Qualcomm internal bug CR580567...

CVE-2014-9791

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0196. Reason: This candidate is a reservation duplicate of CVE-2014-0196. Notes: All CVE users should reference CVE-2014-0196 instead of this candidate. All references and descriptions in this candidate have been removed to...

CVE-2014-9792

arch/arm/mach-msm/ipcrouter.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices uses an incorrect integer data type, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28769399 and Qualcomm internal bug CR550606...

CVE-2014-9779

arch/arm/mach-msm/qdsp6v2/msmaudioion.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allows attackers to obtain sensitive information from kernel memory via a crafted offset, aka Android internal bug 28598347 and Qualcomm internal bug CR548679...

CVE-2014-9796

app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 2013 devices does not validate the page size in the kernel header, which allows attackers to bypass intended access restrictions via a crafted boot image, aka Android internal bug 28820722 and Qualcomm...

CVE-2014-9787

Integer overflow in drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-07-05 on Nexus 7 2013 devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28571496 and Qualcomm internal bug CR545764...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0196. Reason: This candidate is a reservation duplicate of CVE-2014-0196. Notes: All CVE users should reference CVE-2014-0196 instead of this candidate. All references and descriptions in this candidate have been removed to...

CVE-2014-9786

Heap-based buffer overflow in drivers/media/platform/msm/camerav2/sensor/actuator/msmactuator.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 2013 devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28557260 and Qualcomm...