Security Bulletin: IBM Workload Deployer - Proof of Concept exploit code, which uses a flaw in glibc that can allow a local unprivileged user to gain root on Linux machine

Summary Proof of Concept exploit code, which uses a flaw in glibc that can allow a local unprivileged user to gain root on a Linux machine. This affects virtual machines deployed by IBM Workload Deployer using the IBM OS Image for RedHat Linux version 2.0, 2.0.0.1, 2.0.0.2, 2.0.0.3, 2.0.0.4 and...

CVE-2018-5119

The reader view will display cross-origin content when CORS headers are set to prohibit the loading of cross-origin content by a site. This could allow access to content that should be restricted in reader view. This vulnerability affects Firefox 58...

CVE-2018-5119

The reader view will display cross-origin content when CORS headers are set to prohibit the loading of cross-origin content by a site. This could allow access to content that should be restricted in reader view. This vulnerability affects Firefox 58...

CVE-2018-5119

The CVE-2018-5119 issue affects Mozilla Firefox versions earlier than 58. In Reader View, cross-origin content could be displayed when CORS headers prohibit loading cross-origin content, potentially allowing access to restricted content. Mitigation: upgrade to Firefox 58 or newer where this is fi...

Drive-by download campaign targets Chinese websites, experiments with exploits

During our web crawls we sometimes come across bizarre findings or patterns we haven't seen before. This was the case with a particular drive-by download attack planted on Chinese websites. While by no means advanced it turned out to be fairly buggy, we witnessed a threat actor experimenting with...

Mozilla Firefox < 58 Multiple Vulnerabilities (macOS)

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 58. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes. C Tenable Network Security, Inc. include'compat.inc'; if description...

Design/Logic Flaw

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific...

CVE-2017-16596

NetGain Systems Enterprise Manager 7.2.730 build 1034 is affected by CVE-2017-16596 due to a directory traversal/ improper validation flaw in the org.apache.jsp.u.jsp.designer.script_005fsamples_jsp servlet, which runs on port 8081 by default. Parsing the type parameter allows an attacker to use ...

CVE-2018-5119

The reader view will display cross-origin content when CORS headers are set to prohibit the loading of cross-origin content by a site. This could allow access to content that should be restricted in reader view. This vulnerability affects Firefox 58...

Fedora 27 : chromium (2017-109f8db088)

Update to 61.0.3163.100. Security fix for CVE-2017-5111, CVE-2017-5112, CVE-2017-5113, CVE-2017-5114, CVE-2017-5115, CVE-2017-5116, CVE-2017-5117, CVE-2017-5118, CVE-2017-5119, CVE-2017-5120, CVE-2017-5121, CVE-2017-5122 Note that Tenable Network Security has extracted the preceding description...

CVE-2017-5119

Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page...

CVE-2017-5119

Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page...

CVE-2017-5119

Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page...

CVE-2017-5119

Removed by vendor...

CVE-2017-5119

CVE-2017-5119 concerns the Skia component of Chromium. The initial description notes an uninitialized value in Skia on Chromium before 61.0.3163.79 (and Android 61.0.3163.81), enabling a remote attacker to read potentially sensitive process-memory data via a crafted HTML page (information disclos...

Fedora 26 : chromium (2017-efeb59171d)

Update to 61.0.3163.100. Security fix for CVE-2017-5111, CVE-2017-5112, CVE-2017-5113, CVE-2017-5114, CVE-2017-5115, CVE-2017-5116, CVE-2017-5117, CVE-2017-5118, CVE-2017-5119, CVE-2017-5120, CVE-2017-5121, CVE-2017-5122 Note that Tenable Network Security has extracted the preceding description...

Debian DSA-3985-1 : chromium-browser - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2017-5111 Luat Nguyen discovered a use-after-free issue in the pdfium library. - CVE-2017-5112 Tobias Klein discovered a buffer overflow issue in the webgl library. - CVE-2017-5113 A buffer overflow issue was discover...

[SECURITY] [DSA 3985-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3985-1 [email protected] https://www.debian.org/security/ Michael Gilbert September 28, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3985-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3985-1 [email protected] https://www.debian.org/security/ Michael Gilbert September 28, 2017 https://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-3985-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...