OPENSUSE-SU-2019:2687-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk jdk8u232/icedtea 3.14.0 fixes the following issues: Security issues fixed bsc1154212: - CVE-2019-2933: Windows file handling redux - CVE-2019-2945: Better socket support - CVE-2019-2949: Better Kerberos ccache handling - CVE-2019-2958: Build Better Processes -...

Finding a common language to describe AI security threats

As artificial intelligence AI and machine learning systems become increasingly important to our lives, it’s critical that when they fail we understand how and why. Many research papers have been dedicated to this topic, but inconsistent vocabulary has limited their usefulness. In collaboration wi...

The vulnerability of the FTP protocol implementation that supports Kerberos authentication, as provided by the libcurl library, relates to the reallocation of memory. This vulnerability allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the FTP protocol implementation that supports Kerberos authentication, when using the libcurl library, is related to a memory reclamation error. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service...

The vulnerability of Intel microprocessor microprogramming software, which arises due to insufficient testing of input data, allows a hacker to trigger a service failure.

The vulnerability of Intel microprocessor microprogramming software exists due to insufficient testing of input data. Exploiting this vulnerability can allow an attacker to cause malfunctions in the system...

The vulnerability of the p256-ECDH key generation function in browsers Firefox, Firefox ESR, and the email client Thunderbird allows a hacker to induce a service failure.

The vulnerability of the p256-ECDH key generation function in Firefox browsers, Firefox ESR, and the Thunderbird email client is related to a lack of mechanisms for verifying input data. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the Kernel Mode module in the Intel Graphics Driver allows a hacker to trigger a service failure.

The vulnerability of the Kernel Mode module in the Intel Graphics Driver exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause system failures...

The vulnerability of the microprogramming software of the Intel Baseboard Management Controller (BMC) related to session management errors allows a perpetrator to disclose sensitive information or cause service failures.

The vulnerability of the microprogrammed software of the Intel Baseboard Management Controller BMC relates to session management errors. Exploiting this vulnerability can allow attackers to disclose sensitive information or cause system failures...

The vulnerability of the RPC call handlers of VMware Workstation and VMware Fusion hypervisors allows a attacker to cause a service failure.

The vulnerability of RPC call handlers in VMware Workstation and VMware Fusion hypervisors is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

The vulnerability of Intel WIFI drivers, related to operations beyond the buffer in memory, allows attackers to escalate their privileges, cause service failures, and expose sensitive information.

The vulnerability of Intel WIFI drivers is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow attackers to enhance their privileges, cause service failures, and expose sensitive information...

The vulnerability of the Baseboard Management Controller, a controller for remote control of a computer, arises from operations that go beyond the buffer in memory. This allows attackers to disclose sensitive information, enhance their privileges, or cause system failures.

The vulnerability of the Baseboard Management Controller for remote control involves operations that go beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information, enhance their privileges, or cause service failures...

The vulnerability of the Intel PROSet/Wireless WiFi connection utility is related to incorrect default access rights settings, which allow a malicious actor to trigger a service failure and expose protected information.

The vulnerability of the Intel PROSet/Wireless WiFi networking connection tool is related to incorrect default access rights settings. Exploiting this vulnerability could allow a hacker to cause service failures and expose sensitive information...

Streamlining and Automating Compliance

There are seemingly countless regulatory and industry frameworks out there that organizations have to navigate and comply with. SOX Sarbanes-Oxley, PCI-DSS Payment Card Industry Data Security Standard, GDPR General Data Protection Regulation, HIPAA Health Insurance Portability and Accountability...

The vulnerability of Firefox browsers arises due to insufficient validation of input data, allowing attackers to trigger a service failure.

The vulnerability of the Firefox browser exists due to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures by using specially created URIs...

The vulnerability of the Hyper-V hardware virtualization system in the Windows operating system allows a hacker to trigger a service failure.

The vulnerability of the Hyper-V hardware virtualization system and the Windows operating system is related to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures through a specially created application...

The vulnerability of the Apache Tomcat application server, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the Apache Tomcat application server is related to an uncontrolled consumption of resources. Exploiting this vulnerability allows a malicious actor to cause service failures when the WINDOWUPDATE message is not sent to the connection window thread 0...

SUSE SLES12 Security Update : squid (SUSE-SU-2019:3067-1)

This update for squid to version 4.9 fixes the following issues : Security issues fixed : CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi bsc1140738. CVE-2019-12526: Fixed potential remote code execution during URN processing bsc1156326...

SUSE-SU-2019:3067-1 Security update for squid

This update for squid to version 4.9 fixes the following issues: Security issues fixed: - CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi bsc1140738. - CVE-2019-12526: Fixed potential remote code execution during URN processing bsc1156326. -...

CVE-2019-15972

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates SQL values. ...

The vulnerability of the Jetty HTTP server, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the Jetty HTTP server is related to an uncontrolled resource consumption. Exploiting this vulnerability allows a malicious actor to cause service failures by sending containers containing SETTINGs, or multiple SETTINGs...

The vulnerability of Siemens’ software and hardware devices, related to the possibility of disrupting time synchronization (IRT), allows a perpetrator to trigger a service failure.

The vulnerability of Siemens’ software and hardware devices is related to the possibility of disrupting time synchronization IRT. Exploiting this vulnerability can allow a remote attacker to cause service failures...