CVE-2019-11736

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during...

UBUNTU-CVE-2019-11736

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during...

EulerOS 2.0 SP5 : gvfs (EulerOS-SA-2019-1968)

According to the versions of the gvfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not...

CVE-2019-3756

RSA Archer, versions prior to 6.6 P3 6.6.0.3, contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions...

CVE-2019-6831

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module all firmware versions, which could cause disconnection of active connections when an unusually high number of IEC 60870- 5-104 packets are received by the module on por...

CVE-2019-6813

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module all firmware versions and Modicon M340 controller all firmware versions, which could cause denial of service when truncated SNMP packets on port 161/UDP are received by...

CVE-2019-6811

Affected product: Schneider Electric Modicon Quantum 140 NOE771x1 (version 6.9 and earlier). Root cause: Improper check for unusual or exceptional conditions (CWE-754) when handling IP fragmented packets. Impact: Denial of service; module may require a power cycle to recover. Evidence in connecte...

CVE-2019-6833

A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU, which could cause a temporary freeze of the HMI when a high rate of frames is receive...

CVE-2019-6813: Improper Check for Unusual or Exceptional Conditions

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module all firmware versions and Modicon M340 controller all firmware versions, which could cause denial of service when truncated SNMP packets on port 161/UDP are received by...

Friday Squid Blogging: Why Mexican Jumbo Squid Populations Have Declined

A group of scientists conclude that it's shifting weather patterns and ocean conditions. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

cPanel Competitive Conditions Vulnerability

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A Competing Conditions Issue vulnerability exists in versions of cPanel prior to 68.0.27. The vulnerability stems from improper...

Microsoft Windows Remote Desktop Services CVE-2019-1182 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the affected system. Failed attacks will cause denial-of-service conditions. Technologies Affected Microsoft Windows 10 Version 1607 for...

Security update for zstd (moderate)

openSUSE Security Update: Security update for zstd Announcement ID: openSUSE-SU-2019:1845-1 Rating: moderate References: 1082318 1133297 1142941 Cross-References: CVE-2019-11922 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has two fixes is now available...

RHEL 7 : kernel-rt (RHSA-2019:2043)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2043 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

RHEL 7 : kernel (RHSA-2019:2029)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2029 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: Kernel: vhostnet: infinite loop while...

Wind River Systems VxWorks Competitive Conditions Issue Vulnerability

Wind River Systems VxWorks is an embedded real-time operating system RTOS from Wind River Systems. A competitive conditions issue vulnerability exists in Wind River Systems VxWorks. The vulnerability arises from improper handling of concurrent access when concurrent code requires mutually exclusi...

Eclipse OpenJ9 Competitive Conditions Issue Vulnerability

Eclipse OpenJ9 is a Java application engine from the Eclipse Foundation. The product is primarily used to run Java applications. A Competing Conditions Issue vulnerability exists in Eclipse OpenJ9 versions prior to 0.15. The vulnerability stems from improper handling of concurrent access when...

CVE-2019-2241: Improper Handling of Exceptional Conditions

While rendering the layout background, Error status check is not caught properly and also incorrect status handling is being done leading to unintended SUI behaviour in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer...

CVE-2019-2240: Improper Handling of Exceptional Conditions

While sending the rendered surface content to the screen, Error handling is not properly checked results in an unpredictable behaviour in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,...

MGASA-2019-0214 Updated gvfs packages fix security vulnerabilities

Updated gvfs package fixes security vulnerabilities: daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used CVE-2019-12447. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write CVE-2019-12448...