Product security update: Virtuozzo 6.0 Update 12 Hotfix 4

The new packages for Virtuozzo 6.0.12 introducing security fixes as well as stability bug fixes. Vulnerability id: PSBM-60778 Possible crash in memcpyfromiovecend triggered from inside container. Vulnerability id: PSBM-59962 Improved isolation for neighbor table settings...

Xxe

IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference ...

Kernel Vulnerability

A vulnerability exists in the kernel of PAN-OS that may result in an elevation of privilege. This issue is publicly known as Dirty COW ref PAN-68074 / CVE-2016-5195. PAN-OS may be impacted by the Dirty COW CVE-2016-5195 attack. A race condition was found in the way the Linux kernel's memory...

Critical product security update: Virtuozzo 6.0 Update 12 Hotfix 3

The new packages for Virtuozzo 6.0.12 introducing security fixes as well as stability and usability bug fixes. Vulnerability id: PSBM-58281 A flaw found in the way prl-vzvncserver parsed terminal escape sequences that could allow a remote attacker authenticated with the VNC password or a user...

CVE-2016-6060

CVE-2016-6060 affects IBM Rational DOORS Next Generation (DRN) 4.0–6.0.2 and related 5.x/4.x components. The vulnerability allows a JazzGuest user to see project names without proper permissions (undisclosed root cause). Affected: DRN 6.0–6.0.2, DRN 5.0–5.0.2, Rational Requirements Components 4.0...

IBM UrbanCode Deploy Security Bypass Vulnerability (CNVD-2017-01414)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

CVE-2017-1127

CVE-2017-1127 affects IBM Rational DOORS Next Generation and related DOORS/RRC components. The connected IBM security bulletin confirms a cross-site scripting (XSS) vulnerability in DNG/RRC Web UI that allows embedding arbitrary JavaScript, potentially leading to credential disclosure within a tr...

CVE-2016-9748

The CVE-2016-9748 issue affects IBM Rational DOORS Next Generation (RDNG) and related configurations as described in IBM’s advisory. Affected versions include RDNG 6.0–6.0.2, RDNG 5.0–5.0.2, Rational Requirements Composer 4.0.7. The root cause is the disclosure of sensitive information in error r...

CVE-2016-6032

CVE-2016-6032 affects IBM Rational Team Concert in the Rational CLM stack (RTC 4.0–6.0.x). The issue is a cross-site scripting vulnerability in the Web UI that allows an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The IBM securit...

CVE-2017-0422

A denial of service vulnerability in Bionic DNS could enable a remote attacker to use a specially crafted network packet to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1,...

CVE-2017-0424

An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission levels. This issue is rated as Moderate because it is a general bypass for a user level defense in depth or exploit mitigation technology ...

UBUNTU-CVE-2017-0418

An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally...

CVE-2017-0414

An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does...

Denial of service

A denial of service vulnerability in Bionic DNS could enable a remote attacker to use a specially crafted network packet to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1,...

Privilege escalation

An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally...

Information disclosure

An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does...

CVE-2017-0420

An information disclosure vulnerability in AOSP Mail could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not...

UBUNTU-CVE-2017-0421

An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application...

CVE-2017-0422

A denial of service vulnerability in Bionic DNS could enable a remote attacker to use a specially crafted network packet to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1,...

CVE-2017-0413

CVE-2017-0413 is an information-disclosure vulnerability in AOSP Messaging on Android (versions 6.0, 6.0.1, 7.0, 7.1.1). The issue could allow a local malicious application to bypass OS protections that isolate app data, exposing data the app should not access. The description and connected sourc...