SUSE-SU-2018:0573-1 Security update for the Linux Kernel (Live Patch 7 for SLE 12 SP2)

This update for the Linux Kernel 4.4.59-9217 fixes one issue. The following security issue was fixed: - CVE-2017-18075: crypto/pcrypt.c in the Linux kernel mishandled freeing instances, allowing a local user able to access the AFALG-based AEAD interface CONFIGCRYPTOUSERAPIAEAD and pcrypt...

SUSE-SU-2018:0574-1 Security update for the Linux Kernel (Live Patch 8 for SLE 12 SP2)

This update for the Linux Kernel 4.4.59-9220 fixes one issue. The following security issue was fixed: - CVE-2017-18075: crypto/pcrypt.c in the Linux kernel mishandled freeing instances, allowing a local user able to access the AFALG-based AEAD interface CONFIGCRYPTOUSERAPIAEAD and pcrypt...

SUSE-SU-2018:0568-1 Security update for the Linux Kernel (Live Patch 5 for SLE 12 SP2)

This update for the Linux Kernel 4.4.49-9211 fixes one issue. The following security issue was fixed: - CVE-2017-18075: crypto/pcrypt.c in the Linux kernel mishandled freeing instances, allowing a local user able to access the AFALG-based AEAD interface CONFIGCRYPTOUSERAPIAEAD and pcrypt...

New Android malware record voice calls for extortion & blackmailing

By Waqas Another day, another Android malware - This time IT security This is a post from HackRead.com Read the original post: New Android malware record voice calls for extortion & blackmailing...

Design/Logic Flaw

Blue River Mura CMS before v7.0.7029 supports inline function calls with an m tag and /m end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an m$.dspinclude"../pathname/executable.jpeg"/m approach, where executable.jpeg...

CVE-2018-7486

Blue River Mura CMS before v7.0.7029 supports inline function calls with an m tag and /m end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an m$.dspinclude"../pathname/executable.jpeg"/m approach, where executable.jpeg...

CVE-2018-7486

Blue River Mura CMS before v7.0.7029 is affected by an arbitrary code execution vulnerability. The issue arises from supporting inline function calls using [m]...[/m] tags without proper restrictions on file types or pathnames, enabling a remote attacker to trigger code execution via an [m]$.dspi...

CVE-2018-7301

eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sending arbitrary XML-RPC requests to control the attached BidCos devices...

Code injection

In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function showfloppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addresses to find the locations of kernel...

CVE-2018-7273

In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function showfloppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addresses to find the locations of kernel...

CVE-2018-7273

In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function showfloppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addresses to find the locations of kernel...

NAT32 2.2 Build 22284 - Remote Command Execution

NAT32 2.2 Build 22284 - Remote Command Execution + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NAT32-REMOTE-COMMAND-EXECUTION-CVE-2018-6940.txt + ISR: Apparition Security -- D1rty0tis Vendor: ============= www.nat32.com Product:...

NAT32 Build 22284 Remote Command Execution

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NAT32-REMOTE-COMMAND-EXECUTION-CVE-2018-6940.txt + ISR: Apparition Security -- D1rty0tis Vendor: ============= www.nat32.com Product: ================= NAT32 Build 22284 NAT32 is a...

NAT32 2.2 Build 22284 - Remote Command Execution Vulnerability

Exploit for windows platform in category web applications + Credits: hyp3rlinx Vendor: ============= www.nat32.com Product: ================= NAT32 Build 22284 NAT32 is a versatile IP Router implemented as a WIN32 application. Vulnerability Type: =================== Remote Command Execution CVE...

DEBIAN-CVE-2018-6871

LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function...

CVE-2018-6871

LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function...

KLA11198 RLF vulnerability in LibreOffice

A vulnerability was found in LibreOffice. By exploiting this vulnerability malicious users can read local files. This vulnerability can be exploited via WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function. Original advisories LibreOffice Security Advisory Exploitation...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0233-1)

This update for the Linux Kernel 3.12.61-52111 fixes one issue. The following security issue was fixed : - CVE-2017-15649: net/packet/afpacket.c in the Linux kernel allowed local users to gain privileges via crafted system calls that trigger mishandling of packetfanout data structures, because of...

Code injection

crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access the AFALG-based AEAD interface CONFIGCRYPTOUSERAPIAEAD and pcrypt CONFIGCRYPTOPCRYPT to cause a denial of service kfree of an incorrect pointer or possibly have unspecified other...

DEBIAN-CVE-2017-18075

crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access the AFALG-based AEAD interface CONFIGCRYPTOUSERAPIAEAD and pcrypt CONFIGCRYPTOPCRYPT to cause a denial of service kfree of an incorrect pointer or possibly have unspecified other...