UBUNTU-CVE-2018-20217

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 aka krb5 before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type single-DES, triple-DES, or RC4, the attacker can crash the KDC by making an S4U2Self request...

com.cibuddy:karaf.assembly (1.0.0), org.apache.james.karaf:james-karaf-distribution (>=3.0.0-beta5, <=3.0.1) +2 more potentially affected by CVE-2018-11786 via org.apache.karaf:apache-karaf (2.3.0)

org.apache.karaf:apache-karaf MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - com.cibuddy:karaf.assembly 1.0.0 - org.apache.james.karaf:james-karaf-distribution =3.0.0-beta5,...

org.esigate:esigate-cas (4.0), org.esigate:esigate-distribution (4.0) +4 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.0)

org.esigate:esigate-core MAVEN version 4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 4.0 - org.esigate:esigate-distribution 4.0 - org.esigate:esigate-jsf 4.0 -...

org.esigate:esigate-cas (4.2), org.esigate:esigate-distribution (4.2) +4 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.2)

org.esigate:esigate-core MAVEN version 4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 4.2 - org.esigate:esigate-distribution 4.2 - org.esigate:esigate-jsf 4.2 -...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), org.esigate:esigate-cas (4.4) +5 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.4)

org.esigate:esigate-core MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - de.cezaryrk.olingo:odata-fit 5.0.1-renamed - org.esigate:esigate-cas 4.4 - org.esigate:esigate-distribution 4.4 -...

org.esigate:esigate-cas (>=5.0-beta-1, <=5.2), org.esigate:esigate-distribution (>=5.0-beta-1, <=5.2) +2 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (>=5.0-beta-1, <=5.2)

org.esigate:esigate-core MAVEN version =5.0-beta-1, =5.0-beta-1, =5.0-beta-1, =5.0-beta-1, =5.0-beta-1, =5.2 Source cves: CVE-2018-1000854 Source advisory: OSV:GHSA-HJM9-576Q-399P...

org.esigate:esigate-cas (>=5.0-beta-1, <=5.2), org.esigate:esigate-distribution (>=5.0-beta-1, <=5.2) +2 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (>=5.0-beta-1, <=5.2)

org.esigate:esigate-core MAVEN version =5.0-beta-1, =5.0-beta-1, =5.0-beta-1, =5.0-beta-1, =5.0-beta-1, =5.2 Source cves: CVE-2018-1000854 Source advisory: GHSA-HJM9-576Q-399P...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), org.apache.olingo:odata-fit (>=4.0.0-beta-01-rc01, <=4.0.0-beta-02) +8 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (>=3.1, <=5.2)

org.esigate:esigate-core MAVEN version =3.1, =4.0.0-beta-01-rc01, =3.1, =4.0, =3.1, =3.1, =5.0-beta-1, =3.1, =4.0-beta-2, =3.1, =4.4 Source cves: CVE-2018-1000854 Source advisory: MEND:CVE-2018-1000854...

Erlang Port Mapper Daemon Cookie Remote Code Execution Exploit

The erlang port mapper daemon is used to coordinate distributed erlang instances. Should an attacker get the authentication cookie, remote code execution is trivial. Usually, this cookie is named ".erlang.cookie" and varies on location. This module requires Metasploit:...

RHEL 7 : kernel (RHSA-2018:3843)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3843 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: NULL pointer dereference in...

[SECURITY] [DSA 4352-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4352-1 [email protected] https://www.debian.org/security/ Michael Gilbert December 07, 2018 https://www.debian.org/security/faq -...

Debian DSA-4349-1 : tiff - security update

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...

Samba Denial of Service Vulnerability (CNVD-2019-08293)

Samba is a set of free software developed by the Samba team that enables UNIX series operating systems to connect to the SMB/CIFS network protocol of Microsoft Windows operating systems. The program supports sharing printers, transferring data files to each other, and so on. A denial-of-service...

Discovering Design Principles

Carbon Black recently published a report on the challenges of securing Linux-based operating systems and how Carbon Black is redesigning the approach. For more information about how the CB Predictive Security Cloud, Carbon Black's consolidated endpoint security platform, helps enterprises cut cos...

DEBIAN-CVE-2018-16853

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore t...

Distributing Malware By Becoming an Admin on an Open-Source Project

The module "event-stream" was infected with malware by an anonymous someone who became an admin on the project. Cory Doctorow points out that this is a clever new attack vector: Many open source projects attain a level of "maturity" where no one really needs any new features and there aren't a lo...

Building Better Evaluation Criteria for Linux Security

Carbon Black recently published a report on the challenges of securing Linux-based operating systems and how Carbon Black is redesigning the approach. For more information about how the Cb Predictive Security Cloud, Carbon Black's consolidated endpoint security platform, helps enterprises cut cos...

Debian: Security Advisory (DSA-4343-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CAINE 10.0 - GNU/Linux Live Distribution For Digital Forensics Project, Windows Side Forensics And Incident Response

CAINE Computer Aided INvestigative Environment is an Italian GNU/Linux live distribution created as a Digital Forensics project. Currently, the project manager is Nanni Bassetti Bari - Italy. CAINE offers a complete forensic environment that is organized to integrate existing software tools as...

Intel Distribution Python (IDP) 2018 - Privilege Escalation

Document Title: =============== Intel Distribution Python IDP 2018 - Privilege Escalation References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2166 ID: INTEL-SA-00181 https://nvd.nist.gov/vuln/detail/CVE-2018-12175 https://vuldb.com/fr/?id.123941...