Security Bulletin: Multiple vulnerabilities impact System Storage DS8000 Hardware Management Console (HMC)

Summary Multiple vulnerabilities in the DS8000 Hardware Management Console are covered in this bulletin. These include: - IBM® Runtime Environment Java™ Technology Edition that is used by the DS8000 Hardware Management Console. These issues were disclosed as part of the IBM Java SDK critical patc...

Missing Initialization of Resource in Apache Arrow

It was discovered that the C++ implementation which underlies the R, Python and Ruby implementations of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow...

Missing Initialization of Resource in Apache Arrow

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...

UBUNTU-CVE-2021-44975

radareorg radare2 5.5.2 is vulnerable to Buffer Overflow via /libr/core/analobjc.c mach-o parser...

Amazon Linux 2 : xmlrpc-c (ALAS-2022-1795)

The version of xmlrpc-c installed on the remote host is prior to 1.32.5-1905.svn2451. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1795 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XM...

Missing Initialization of Resource in Apache Arrow

It was discovered that the C++ implementation which underlies the R, Python and Ruby implementations of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow...

C-DATA FD702XW-X-R430 操作系统命令注入漏洞

The C-DATA FD702XW-X-R430 is a router from the Chinese company C-DATA. The C-DATA FD702XW-X-R430 v2.1.13X001 suffers from an operating system command injection vulnerability that stems from the lack of escaping and filtering of data in the vacmd parameter in formlanipv6. An attacker can exploit...

PT-2022-19551 · Unknown · C-Data Fd702Xw-X-R430

Name of the Vulnerable Software and Affected Versions: C-DATA FD702XW-X-R430 version 2.1.13 X001 Description: A command injection issue was discovered, allowing attackers to execute arbitrary commands via a crafted HTTP request. This is achieved through the va cmd parameter in the formlanipv6...

Critical: xmlrpc-c

Issue Overview: A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor...

Amazon Linux AMI : xmlrpc-c (ALAS-2022-1585)

The version of xmlrpc-c installed on the remote host is prior to 1.22.04-r1934.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1585 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML...

Missing Initialization of Resource in Apache Arrow

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...

Critical: xmlrpc-c

Issue Overview: A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor...

CVE-2021-42586

A heap buffer overflow was discovered in copybytes in decoder2007.c in dwgread before 0.12.4 via a crafted dwg file...

CVE-2021-42586

A heap buffer overflow was discovered in copybytes in decoder2007.c in dwgread before 0.12.4 via a crafted dwg file...

Heap overflow

A heap buffer overflow was discovered in copybytes in decoder2007.c in dwgread before 0.12.4 via a crafted dwg file...

CVE-2021-42586

CVE-2021-42586 affects GNU LibreDWG prior to 0.12.4, where a boundary/heap issue in decode_r2007.c: copy_bytes can trigger a heap buffer overflow when processing crafted DWG files. Several sources (SUSE, CNVD, NVD/NVD entry) confirm the vulnerability and version target. Impact is a heap overflow,...

CVE-2021-42585

The CVE-2021-42585 entry concerns GNU LibreDWG (a C library for processing DWG files). A heap buffer overflow was reported in copy_compressed_bytes within decode_r2007.c when processing untrusted input, affecting LibreDWG versions prior to 0.12.4 and triggered by crafted DWG files. Root cause ide...

Out-of-bounds read in function gchar_cursor

Description Out-of-bounds read in function gcharcursor at misc1.c:532 vim version git log commit 68e64d2c1735f2a39afa8a0475ae29bedb116684 HEAD - master, tag: v8.2.5006, origin/master, origin/HEAD POC ./vim -u NONE -i NONE -n -m -X -Z -e -s -S /mnt/share/max/fuzz/poc/vim/poch11s.dat -c :qa!...

CVE-2019-9035

An issue was discovered in libmatio.a in matio aka MAT File I/O Library 1.5.13. There is a stack-based buffer over-read in the function ReadNextStructField in mat5.c...

Are You in the 2.5% Who Meet This Cybersecurity Job Requirement?

Of course you’re special. So are we. But decades of research tells us humans believe they’re good multitaskers – and we are really, seriously not. It seems a measly 2.5% of us can multitask well. The rest of us are best when we focus on a single goal, allowing the left and right sides of our brai...