Important: Red Hat Security Advisory: Red Hat Fuse 7.8.0 release and security update

A minor version update from 7.7 to 7.8 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

CVE-2020-3774

Adobe Photoshop CC 2019 (20.0.8 and earlier) and Photoshop 2020 (21.1 and earlier) are affected by a buffer-related vulnerability (CVE-2020-3774) that could allow arbitrary code execution on successful exploitation. Multiple vendor/open-source sources corroborate a memory/buffer corruption patter...

Adobe Photoshop CC 20.x < 20.0.9 / 21.x < 21.1.1 Multiple Vulnerabilities (APSB20-14)

The version of Adobe Photoshop CC or Photoshop installed on the remote Windows host is prior to 20.0.9/21.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb20-14 advisory. - Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 an...

Adobe Photoshop CC 20.x < 20.0.9 / 21.x < 21.1.1 Multiple Vulnerabilities (macOS APSB20-14)

The version of Adobe Photoshop CC or Photoshop installed on the remote macOS or Mac OS X host is prior to 20.0.9/21.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb20-14 advisory. - Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versio...

be.dnsbelgium:rdap-server (>=0.3.3 <=1.1.0), com.bazoud.metrics:metrics-spring-batch (=1.0) +135 more potentially affected by CVE-2019-3774 via org.springframework.batch:spring-batch-core (>=1.0.0.FINAL <=3.0.0.RELEASE)

org.springframework.batch:spring-batch-core MAVEN version =1.0.0.FINAL, =0.3.3, =0.0.4, =0.2.4, =0.1.0, =1.0.2, =1.0.2, =1.3, =0.3.1, =0.2.0, =0.2.3 and more Source cves: CVE-2019-3774 Source advisory: OSV:GHSA-3WC8-659G-R88Q...

cloud.altemista.fwk.batch:cloud-altemistafwk-core-batch-spring (>=3.0.0.RELEASE <=3.0.1.RELEASE), cloud.altemista.fwk.batch:cloud-altemistafwk-core-batch-spring-conf (>=3.0.0.RELEASE <=3.0.1.RELEASE) +46 more potentially affected by CVE-2019-3774 via org.springframework.batch:spring-batch-core (>=4.0.0.RELEASE <=4.0.1.RELEASE)

org.springframework.batch:spring-batch-core MAVEN version =4.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0, =1.0.0, =1.0.1, =1.0.0, =1.0.1, =2.0.0.RELEASE, =2.0.0.RELEASE, =2.0.1.RELEASE and more Source cves: CVE-2019-3774 Source advisory: OSV:G...

com.github.chrisgleissner:spring-batch-rest-api (>=1.0.3 <=1.2.7), com.github.chrisgleissner:spring-batch-rest-example (>=1.0.3 <=1.2.7) +7 more potentially affected by CVE-2019-3774 via org.springframework.batch:spring-batch-core (=4.1.0.RELEASE)

org.springframework.batch:spring-batch-core MAVEN version =4.1.0.RELEASE is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.batch:spring-batch-core and may be impacted: - com.github.chrisgleissner:spring-batch-rest-api =1.0.3, =1.0.3,...

CVE-2019-3774

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3774 Spring Batch XML External Entity Injection (XXE)

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3774

CVE-2019-3774 affects Spring Batch versions 3.0.9, 4.0.1, 4.1.0 and older unsupported versions. It is caused by an XML External Entity (XXE) vulnerability when processing XML data from untrusted sources. Public scoring indicates high severity (CVSS v3 base 9.8; v2 base 7.5). No remediation or fix...

CVE-2018-3774

Incorrect parsing in url-parse 1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol...

CVE-2018-3774

CVE-2018-3774 affects the url-parse library prior to 1.4.3 and stems from incorrect hostname parsing. This can enable SSRF, open redirect, and potential bypass of authentication in affected workflows that rely on url-parse for URL handling. Exploitation scenarios include misparsing hosts in URLs ...

CVE-2017-3774

CVE-2017-3774 describes a stack overflow in the IMM2 web administration service. The vulnerability affects IMM2 firmware earlier than 4.70 on Lenovo servers and earlier than 6.60 on some IBM servers, where a crafted user ID and password can overflow the authentication routine’s stack, causing sta...

IMM2 Web Service Stack Overflow - Lenovo Support US

Lenovo Security Advisory: LEN-19586 Potential Impact: Stack overflow leading to memory corruption Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2017-3774 Summary Description: A stack overflow vulnerability was discovered within the web administration service in the...

IMM2 Web Service Stack Overflow - NL

Lenovo Security Advisory: LEN-19586 Potential Impact: Stack overflow leading to memory corruption Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2017-3774 Summary Description: A stack overflow vulnerability was discovered within the web administration service in the...

Debian DSA-3774-1 : lcms2 - security update

Ibrahim M. El-Sayed discovered an out-of-bounds heap read vulnerability in the function TypeMLURead in lcms2, the Little CMS 2 color management library, which can be triggered by an image with a specially crafted ICC profile and leading to a heap memory leak or denial-of-service for applications...

Debian: Security Advisory (DSA-3774-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-3774

The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 29008609 and MediaTek internal bug ALPS02703102...

CVE-2016-3774

The CVE-2016-3774 entry concerns a privilege-escalation flaw in MediaTek drivers on Android One devices. The affected component is the MediaTek driver stack present in Android prior to 2016-07-05, with root-cause attribution to Android internal bug 29008609 and MediaTek internal bug ALPS02703102....

CVE-2015-3774

CVE-2015-3774 affects the Dictionary app in OS X prior to 10.10.5. The root cause is that Dictionary queries were not secured with HTTPS, enabling MITM interception or tampering. The connected OpenVAS/Nessus entries confirm the issue and indicate remediation: Dictionary communications have been m...