373 matches found
CVE-2018-14339
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the MMSE dissector could go into an infinite loop. This was addressed in epan/proto.c by adding offset and length validation...
Buffer overflow
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash. This was addressed in epan/tvbuffzlib.c by rejecting negative lengths to avoid a buffer over-read...
CVE-2018-14342
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the BGP protocol dissector could go into a large loop. This was addressed in epan/dissectors/packet-bgp.c by validating Path Attribute lengths...
Security Bulletin: Vulnerabilities in OpenSSL affects IBM Tivoli Composite Application Manager for Transactions
Summary Vulnerabilities in OpenSSL were disclosed by openssl.org. OpenSSL 1.0.2j, used by IBM Tivoli Composite Application Manager for Transactions ISM, has addressed these vulnerabilities. Vulnerability Details CVE-ID: CVE-2000-1254 Description: OpenSSL could allow a remote attacker to obtain...
Security Bulletin: Vulnerabilities in OpenSSL affect Tivoli Storage FlashCopy Manager Unix (CVE-2016-6303, CVE-2016-2182, CVE-2016-2177, CVE-2016-2183, CVE-2016-6309, CVE-2016-7052, CVE-2016-2178, CVE-2016-6306)
Summary OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL used by Tivoli Storage FlashCopy Manager IBM Spectrum Protect Snapshot Unix has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-6303 DESCRIPTION: OpenSSL is vulnerable ...
Security Bulletin: Multiple vulnerabilities addressed in the IBM Emptoris Supplier Lifecycle Management product (CVE-2016-8949, CVE-2017-1448, CVE-2016-6121)
Summary The security bulletin includes multiple vulnerabilities found and addressed in IBM Emptoris Supplier Lifecycle Management across various versions of the product. Vulnerability Details CVEID: CVE-2016-8949 DESCRIPTION: IBM Emptoris Supplier Lifecycle Management could allow a remote attacke...
Security Bulletin: IBM Informix Dynamic Server is affected by a privilege escalation vulnerability
Summary IBM Informix Dynamic Server has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1508 DESCRIPTION: IBM Informix Dynamic Server could allow a local user logged in with database administrator user to gain root privileges. CVSS Base Score: 6.7 CVSS Temporal Score:...
Security Bulletin: IBM OpenPages GRC Platform has addressed insecure object reference (CVE-2017-1148)
Summary IBM OpenPages GRC Platform with OpenPages Loss Event Entry LEE application addressed potential security exposure due to insecure object reference. Vulnerability Details CVEID: CVE-2017-1148 DESCRIPTION: IBM OpenPages GRC Platform with OpenPages Loss Event Entry LEE application could allow...
Security Bulletin: IBM API Connect is affected by an OpenSSL vulnerability (CVE-2017-3736)
Summary IBM API Connect has addressed the following vulnerability. OpenSSL could allow a remote attacker to obtain sensitive information, caused by a carry propagation flaw in the x8664 Montgomery squaring function bnsqrx8xinternal. An attacker with online access to an unpatched system could...
CVE-2018-9261
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the NBAP dissector could crash with a large loop that ends with a heap-based buffer overflow. This was addressed in epan/dissectors/packet-nbap.c by prohibiting the self-linking of DCH-IDs...
CVE-2018-7324
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-sccp.c had an infinite loop that was addressed by using a correct integer data type...
Hackers Use New Flash Zero-Day Exploit to Distribute FinFisher Spyware
FinSpy—the infamous surveillance malware is back and infecting high-profile targets using a new Adobe Flash zero-day exploit delivered through Microsoft Office documents. Security researchers from Kaspersky Labs have discovered a new zero-day remote code execution vulnerability in Adobe Flash,...
June 13, 2017—KB4022715 (OS Build 14393.1358)
None None...
Security vulnerabilities fixed in Firefox ESR 45.9 — Mozilla
A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. A use-after-free vulnerability occurs during transaction processing in t...
shopify-scripts: Null pointer dereferences in kh_copy_mt
@ssarong reported an input that triggers a null pointer dereference: https://github.com/mruby/mruby/pull/3615 The issue was addressed in https://github.com/mruby/mruby/commit/de969942338ac440294eefb2e7846a6975f4efdd...
CVE-2016-7957
In Wireshark 2.2.0, the Bluetooth L2CAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-btl2cap.c by avoiding use of a seven-byte memcmp for potentially shorter strings...
OPENSUSE-SU-2017:0563-1 Security update for Chromium
This update to Chromium 55.0.2883.75 fixes the following vulnerabilities: - CVE-2016-9651: Private property access in V8 - CVE-2016-5208: Universal XSS in Blink - CVE-2016-5207: Universal XSS in Blink - CVE-2016-5206: Same-origin bypass in PDFium - CVE-2016-5205: Universal XSS in Blink -...
CVE-2016-9376
In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the OpenFlow dissector could crash with memory exhaustion, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-openflowv5.c by ensuring that certain length values were sufficiently large...
Debian Security Advisory DSA 3039-1 (chromium-browser - security update)
Several vulnerabilities were discovered in the chromium web browser. CVE-2014-3160 Christian Schneider discovered a same origin bypass issue in SVG file resource fetching. CVE-2014-3162 The Google Chrome development team addressed multiple issues with potential security impact for chromium...