SUSE: Security Advisory (SUSE-SU-2022:3679-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated libtiff packages fix security vulnerability

libtiff's tiffcrop utility has a uint32t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop likely via tricking a user to run tiffcrop on it with certain parameters could cause a crash or in some cases, further exploitation. CVE-2022-2867...

Ubuntu: Security Advisory (USN-5604-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5604-1: LibTIFF vulnerabilities

It was discovered that LibTIFF incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. CVE-2022-2867, CVE-2022-2869 It was discovered that LibTIFF incorrectly handled certain files. An attacker could possibly u...

Ubuntu 16.04 ESM : LibTIFF vulnerabilities (USN-5604-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5604-1 advisory. It was discovered that LibTIFF incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service, or possibly...

SUSE SLED15: u-boot-avnetultra96rev1 / u-boot-avnetultra96rev1-doc / etc (SUSE-SU-2022:2868-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2868-1 advisory. - CVE-2022-33103: Fixed a flaw in the squashfs subsystem that could lead to arbitrary code execution...

CVE-2022-2868

creationtimestamp| type| source ---|---|--- 2022-08-18 02:40:44+00:00| seen| https://t.me/cibsecurity/48322...

CVE-2022-2868

libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop...

CVE-2022-2868

CVE-2022-2868 affects libtiff’s tiffcrop utility, due to improper input validation that can lead to an out-of-bounds read and crash when processing a crafted TIFF file. Public advisories and vendor notes reference DoS/crash implications and provide fixes by updating libtiff to versions containing...

CVE-2020-2868

CVE-2020-2868 affects Oracle PeopleSoft Enterprise PeopleTools Diagnostic Framework in versions 8.56–8.58. The vulnerability allows an unauthenticated attacker with network access over HTTP to compromise PeopleSoft PeopleTools, potentially enabling unauthorized read, update, insert, or delete of ...

Important: Red Hat Security Advisory: dbus security update

An update for dbus is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

CVE-2019-2868

CVE-2019-2868 affects the Oracle Berkeley DB Data Store component. Affects multiple 12.1.6.x releases (e.g., 12.1.6.1.23, .26, .29, .36, and 12.1.6.2.x .23/.32). The vulnerability is described as difficult to exploit and could allow an attacker who can log on to the infrastructure where Data Stor...

Security Bulletin: IBM QRadar SIEM is vulnerable to untrusted XML External Entity uploads. (CVE-2016-2868)

Summary XML External Entity injection in the UI of QRadar allows someone with privileges to upload unvalidated XML. Vulnerability Details CVE-ID: CVE-2016-2868 Description: IBM QRadar could allow a remote attacker with administrator privileges to obtain sensitive information, caused by an error...

Natus Xltek NeuroWorks

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Natus Medical, Inc. Natus Equipment: Natus Xltek NeuroWorks software Vulnerabilities: Stack-Based Buffer Overflow, Out-of-Bounds Read 2. RISK EVALUATION Successful exploitation of these...

CVE-2018-2868

Vulnerability in the Oracle Human Resources component of Oracle E-Business Suite subcomponent: General Utilities. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with netwo...

CVE-2018-2868

CVE-2018-2868 is a vulnerability in Oracle E-Business Suite’s Oracle Human Resources General Utilities. Affected are the 12.1.x and 12.2.x releases (12.1.1–12.1.3, 12.2.3–12.2.7). The issue enables an unauthenticated, network-accessible attacker over HTTP to read a subset of Oracle Human Resource...

CVE-2017-2868

An exploitable code execution vulnerability exists in the NewProducerStream functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause a stack buffer overflow resulting in code execution. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2017-2868

CVE-2017-2868 is a vulnerability in the NewProducerStream functionality of Natus Xltek NeuroWorks 8 . The issue stems from parsing a user-provided KeyTree, specifically an unchecked length for the SlowReviewLocalPath used to construct a path, which can overflow a stack buffer and overwrite except...

CVE-2015-2868

An exploitable remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in DSS service. An attacker who can connect to the DSS service on the Trane ComfortLink II device can send an overly long REG request that can overflow a fixed size stack buffer, resulting...

CVE-2015-2868

CVE-2015-2868 affects Trane ComfortLink II (firmware 2.0.2) in the DSS service. The vulnerability is a remote code execution caused by processing an overly long REG request that overflows a fixed-size stack buffer. Investigations describe unsafe input handling (sscanf and strcpy) in the DSS reque...