Fedora 31 : elog (2020-f49fe7f011)

Security fix for CVE-2019-3993, CVE-2019-3994, CVE-2019-3995, CVE-2019-3992, CVE-2019-3996 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possibl...

Fedora 30 : elog (2020-9f8bc040c8)

Security fix for CVE-2019-3993, CVE-2019-3994, CVE-2019-3995, CVE-2019-3992, CVE-2019-3996 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possibl...

CVE-2019-3995

CVE-2019-3995 affects ELOG 3.1.4-57bea22 and earlier. The root cause is a NULL pointer dereference, enabling a remote unauthenticated attacker to crash the ELOG server via a crafted HTTP GET request (DoS). Multiple connected sources confirm Fedora advisories and CNVD entries describing the same i...

Ubuntu 16.04 LTS / 18.04 LTS : Keepalived vulnerability (USN-3995-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3995-1 advisory. It was discovered that Keepalived incorrectly handled certain HTTP status response codes. A remote attacker could use this issue to cause Keepalived t...

Use-After-Free

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Bypass Policy

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

SUSE SLES12 Security Update : Recommended update for php5 (SUSE-SU-2018:3995-1)

This update for php5 fixes the following issues : Security issue fixed : CVE-2018-19518: Fixed imapopen script injection flaw bsc1117107. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatical...

Foxit Reader < 9.3 Multiple Vulnerabilities

The version of Foxit Reader installed on the remote Windows host is prior to 9.3. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid118093; scriptversion"1.7"; scriptsetattributeattribute:"pluginmodificationdate",...

CVE-2018-3995

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user...

CVE-2018-3995

CVE-2018-3995 affects Foxit PDF Reader (JS engine); a vulnerability in the JavaScript engine of Foxit PDF Reader 9.2.0.9297 allows a crafted PDF to trigger a previously freed object, enabling arbitrary code execution. The impact is contingent on successfully triggering the freed object reuse. Att...

Foxit Reader and PhantomPDF Multiple Use After Free Vulnerabilities (CVE-2018-3940; CVE-2018-3941; CVE-2018-3942; CVE-2018-3943; CVE-2018-3944; CVE-2018-3945; CVE-2018-3946)

A remote code execution vulnerability exists in Foxit Reader and PhantomPDF. The vulnerability is due to a use-after-free error while handling a specially crafted PDF file. Successful exploitation could lead to arbitrary code execution. Additional CVEs: CVE-2018-3957, CVE-2018-3958, CVE-2018-3959...

Security Bulletin: A vulnerability in crypto++ affects PowerKVM (CVE-2016-3995)

Summary PowerKVM is affected by a vulnerability in crypto++ aka cryptopp. This vulnerability is now fixed. Vulnerability Details CVEID: CVE-2016-3995 DESCRIPTION: Crypto++ could allow a remote attacker to bypass security restrictions, caused by a timing attack error. A remote attacker could explo...

CVE-2008-3995

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/sqli/oracle/dbmscdcpublish.rb 2025-02-06 03:13:39+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:08:31+00:00| seen|...

CVE-2017-3995

CVE-2017-3995 is rejected/not used; this entry does not represent an active vulnerability.

CVE-2016-3995

The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ aka cryptopp before 5.6.4 may be optimized out by the compiler, which allows attackers to conduct timing attacks...

CVE-2016-3995

The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ aka cryptopp before 5.6.4 may be optimized out by the compiler, which allows attackers to conduct timing attacks...

CVE-2016-3995

Crypto++ (libcryptopp) timing-attack vulnerability CVE-2016-3995 affects Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock prior to version 5.6.4, where the timing-protection code could be optimized out by compilers. This could allow an attacker to perform timing attacks. Th...

CVE-2016-3995

The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ aka cryptopp before 5.6.4 may be optimized out by the compiler, which allows attackers to conduct timing attacks...

Mageia: Security Advisory (MGASA-2016-0147)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2016-0147 Updated libcryptopp packages fix CVE-2016-3995

Updated libcryptopp packages fix security vulnerability: In libcryptopp, for both Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock there is some code to avoid timing attacks, however it is removed by the compiler due to optimizations, making the binary vulnerable to timing...