SUSE-SU-2019:14122-1 Security update for bzip2

This update for bzip2 fixes the following issues: Security issue fixed: - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors bsc1139083. - CVE-2016-3189: Fixed a use-after-free in bzip2recover bsc985657...

Slackware 14.0 / 14.1 / 14.2 / current : bzip2 (SSA:2019-195-01)

New bzip2 packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2019-195-01. The text itself is copyright C Slackware Linux...

SUSE-SU-2019:1206-2 Security update for bzip2

This update for bzip2 fixes the following issues: Security issue fixed: - CVE-2016-3189: Fixed a use-after-free in bzip2recover bsc985657...

FreeBSD : bzip2 -- multiple issues (4b6cb45d-881e-447a-a4e0-c97a954ea758)

bzip2 developers reports : CVE-2016-3189 - Fix use-after-free in bzip2recover Jakub Martisko CVE-2019-12900 - Detect out-of-range nSelectors in corrupted files Albert Astals Cid. Found through fuzzing karchive. C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

Ubuntu: Security Advisory (USN-4038-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 LTS / 18.04 LTS : bzip2 vulnerabilities (USN-4038-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4038-1 advisory. Aladdin Mubaied discovered that bzip2 incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of...

USN-4038-1 bzip2 vulnerabilities

Aladdin Mubaied discovered that bzip2 incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. CVE-2016-3189 It was discovered that bzip2 incorrectly handled certain files. An attacker could possibly use...

Debian: Security Advisory (DLA-1833-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : bzip2 (openSUSE-2019-1435)

This update for bzip2 fixes the following issues : Security issue fixed : - CVE-2016-3189: Fixed a use-after-free in bzip2recover bsc985657. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

OPENSUSE-SU-2019:1435-1 Security update for bzip2

This update for bzip2 fixes the following issues: Security issue fixed: - CVE-2016-3189: Fixed a use-after-free in bzip2recover bsc985657. This update was imported from the SUSE:SLE-15:Update update project...

openSUSE: Security Advisory for bzip2 (openSUSE-SU-2019:1398-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2019:1398-1 Security update for bzip2

This update for bzip2 fixes the following issues: Security issue fixed: - CVE-2016-3189: Fixed a use-after-free in bzip2recover bsc985657. This update was imported from the SUSE:SLE-15:Update update project...

SUSE SLED15 / SLES15 Security Update : bzip2 (SUSE-SU-2019:1206-1)

This update for bzip2 fixes the following issues : Security issue fixed : CVE-2016-3189: Fixed a use-after-free in bzip2recover bsc985657. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

SUSE-SU-2019:1206-1 Security update for bzip2

This update for bzip2 fixes the following issues: Security issue fixed: - CVE-2016-3189: Fixed a use-after-free in bzip2recover bsc985657...

EulerOS 2.0 SP5 : bzip2 (EulerOS-SA-2019-1020)

According to the version of the bzip2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A use-after-free flaw was found in bzip2recover, leading to a null pointer dereference, or a write to a closed file descriptor. An attacker could us...

CVE-2018-3189

CVE-2018-3189 affects Oracle E-Business Suite’s Customer Interaction History component (subcomponent Outcome-Result) for versions 12.1.1–12.1.3. It is exploitable over HTTP by an unauthenticated attacker and requires user interaction; impacts include unauthorized disclosure and data modification ...

CVE-2017-3189

The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, there are no checks on the types of files which the bundle...

CVE-2017-3189

The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, there are no checks on the types of files which the bundle...

CVE-2017-3189 The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload

The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, there are no checks on the types of files which the bundle...

CVE-2017-3189

dotCMS 3.7.1 and earlier, in Enterprise Pro, is vulnerable in the Push Publishing feature where uploaded Bundle tar.gz archives are decompressed without validation of file types. This leads to a path traversal issue (CVE-2017-3188) and, when combined, enables remote command execution with the per...