Security Bulletin: Pivotal Spring Framework as used in IBM QRadar SIEM is vulnerable to various CVE's

Summary OpenSource Pivotal Spring Framework as used in IBM QRadar is susceptible to several vulnerabilities. Vulnerability Details CVEID: CVE-2013-7315 DESCRIPTION: Pivotal Spring Framework could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection X...

CVE-2018-3578

CVE-2018-3578 is a heap overflow in the Qualcomm WLAN component caused by a type mismatch for ie_len, leading Android CAF/Linux kernel builds to allocate insufficient heap memory. The issue is described as a local vulnerability with HIGH impact (CVSS3: LOCAL, LOW complexity, NO privileges, USER i...

CVE-2018-3578

Type mismatch for ielen can cause the WLAN driver to allocate less memory on the heap due to implicit casting leading to a heap buffer overflow in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

Ubuntu 17.10 : wavpack vulnerabilities (USN-3578-1)

It was discovered that WavPack incorrectly handled certain DSDIFF files. An attacker could possibly use this to execute arbitrary code or cause a denial of service. CVE-2018-7253 It was discovered that WavPack incorrectly handled certain CAF files. An attacker could possibly use this to cause a...

Oracle OIT IX SDK libvs_pdf FlateDecode Colors Denial of Service Vulnerabiity(CVE-2016-3578)

DESCRIPTION A null pointer dereference leading to process crash can occur while parsing a malformed PDF file. TESTED VERSIONS Oracle Outside In IX sdk 8.5.1 PRODUCT URLs http://www.oracle.com/technetwork/middleware/content-management/oit-all-085236.html DETAILS While parsing a PDF file which...

CVE-2017-3578

CVE-2017-3578 describes a vulnerability in the Sun ZFS Storage Appliance Kit (AK) within Oracle Sun Systems Products Suite (subcomponent: RAS subsystems). Affected: AK 2013. The issue is exploitable by a low-privileged attacker who can log on to the infrastructure where AK runs, potentially leadi...

Oracle Outside In Vulnerabilities

This security update addresses the following vulnerabilities, which are described in Oracle Critical Patch Update Advisory – July 2016 Remote Code Execution: CVE-2016-3575, CVE-2016-3581, CVE-2016-3582, CVE-2016-3583, CVE-2016-3595, CVE-2016-3594, CVE-2015-6014, CVE-2016-3593, CVE-2016-3592,...

CVE-2016-3578

CVE-2016-3578: Unspecified vulnerability in the Outside In Technology component of Oracle Fusion Middleware 8.5.0/8.5.1/8.5.2. Affects Outside In Filters and can impact confidentiality, integrity, and availability. Root cause and specific exploit details are not provided in the documents. Exploit...

Oracle OIT IX SDK libvs_pdf FlateDecode Colors Denial of Service Vulnerabiity

Talos Vulnerability Report TALOS-2016-0100 Oracle OIT IX SDK libvspdf FlateDecode Colors Denial of Service Vulnerabiity July 19, 2016 CVE Number CVE-2016-3578 DESCRIPTION A null pointer dereference leading to process crash can occur while parsing a malformed PDF file. TESTED VERSIONS Oracle Outsi...

Debian DSA-3578-1 : libidn - security update

It was discovered that libidn, the GNU library for Internationalized Domain Names IDNs, did not correctly handle invalid UTF-8 input, causing an out-of-bounds read. This could allow attackers to disclose sensitive information from an application using the libidn library. %NASLMINLEVEL 70300 C...

CVE-2014-3578

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL...

CVE-2014-3578

CVE-2014-3578 affects Pivotal Spring Framework 3.x up to 3.2.8 and 4.0 up to 4.0.4. The flaw is a directory traversal vulnerability allowing remote attackers to read arbitrary files via a crafted URL, caused by improper handling of resource access. Exploitation could enable reading sensitive serv...

EXPP (Doc Number=3578): GSKit Fixes Available

Abstract EXPP Doc Number=3578: GSKit Fixes Available Fixes for GSKit Available See the following Security Bulletin for IBM Tivoli Directory Server CPU utilization - shipped with AIX and VIOS Doc number: 3578 Published date: 20140523 Content EXPP Doc Number=3578: GSKit Fixes Available Fixes for...

CVE-2013-3578

The CVE-2013-3578 issue affects Wave EMBASSY ERAS Help Desk (part of ERAS) where input in the ct100$4MainController$TextBoxSearchValue parameter enables SQL injection and, in some cases, command execution on the server. Affected products are ERAS 2.8.4 Help Desk and ERAS 2.9.5 Help Desk; exploita...

Wave EMBASSY Remote Administration Server SQL injection vulnerabilities

Overview The Wave EMBASSY Remote Administration Server ERAS contains the ERAS Help Desk application that fails to filter user input allowing for the exploitation of SQL injection vulnerabilities. These vulnerabilities may allow a remote authenticated attacker to execute procedures or SQL queries...

Gentoo Security Advisory GLSA 201211-01 (MantisBT)

The remote host is missing updates announced in advisory GLSA 201211-01. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

CVE-2012-3578

The CVE covers an unrestricted file upload in the FCChat Widget WordPress plugin (versions up to 2.2.13.1). The vulnerability resides in html/Upload.php, where an attacker can upload a file with an executable extension followed by a safe extension and then access it directly under html/images, en...

Fedora Update for mantis FEDORA-2011-12336

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for mantis FEDORA-2011-12336

Check for the Version of mantis OpenVAS Vulnerability Test Fedora Update for mantis FEDORA-2011-12336 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Fedora 16 : mantis-1.2.8-1.fc16 (2011-12336)

Update to latest upstream release, fixes several security issues detailed in CVE-2011-2938 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...