SUSE-SU-2019:0054-2 Security update for systemd

This update for systemd fixes the following issues: Fix security vulnerabilities CVE-2018-16864 and CVE-2018-16865 bsc1120323: Both issues were memory corruptions via attacker-controlled alloca which could have been used to gain root privileges by a local attacker. Fix security vulnerability...

The vulnerability of the Kernel Mode Driver component of the Intel Graphics Driver allows a hacker to trigger a service failure.

The vulnerability of the Kernel Mode Driver component in Intel Graphics Drivers exists due to insufficient testing of input data. Exploiting this vulnerability can allow an attacker to cause system failures...

The vulnerability of Intel Software Guard Extensions SDK, related to reclaimed memory, allows a hacker to disclose protected information or cause service failures.

The vulnerability of Intel Software Guard Extensions SDK relates to the reallocation of memory. Exploiting this vulnerability can allow attackers to disclose sensitive information or cause service failures...

The vulnerability of the SAP HANA Extended Application Services development tool, related to errors in XML document processing, allows attackers to gain access to protected information or cause service failures.

The vulnerability of the SAP HANA Extended Application Services development tool is related to errors in processing XML documents. Exploiting this vulnerability can allow a malicious actor to gain access to protected information or cause service failures by using a specially created XML file...

The vulnerability of the xfs_attr_shortform_addname function in the XFS file system implementation of Linux operating systems allows a attacker to cause a service failure.

The vulnerability of the xfsattrshortformaddname function in the XFS file system implementation of Linux operating systems is related to incorrect data processing. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the Rapid Storage Technology Enterprise implementation lies in the insufficient verification of input data, which allows attackers to escalate their privileges or cause service failures.

The vulnerability of the Rapid Storage Technology Enterprise data storage technology implementation is related to insufficient verification of input data. Exploiting this vulnerability can allow attackers to enhance their privileges or cause service failures...

Azure DevOps Server and Team Foundation Server Cross-Site Scripting Vulnerability

Azure DevOps Server, formerly known as Team Foundation Server TFS, is a locally hosted set of collaborative software development tools.Azure DevOps Server integrates with existing IDEs or editors to enable cross-functional teams to effectively handle projects of all sizes.Team Foundation Server i...

The vulnerability of the `readSocket` function in the Live555 Media Server library, part of the `liblivemedia` package, allows a attacker to cause a service failure.

The vulnerability of the readSocket function in the GroupsockHelper.cpp library of the Live555 Media Server package from the liblivemedia library exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

The vulnerability of the processmetadata function in the GNU Libextractor library, related to reading beyond the memory boundaries, allows attackers to cause service failures or disclose protected information.

The vulnerability of the processmetadata function in the GNU Libextractor library is related to the issue of reading beyond the memory boundaries. Exploiting this vulnerability could allow a malicious actor to cause service failures or expose protected information...

The vulnerability of the libsolv library, related to pointer dereferencing errors, allows a hacker to trigger a service failure.

The vulnerability of the testcaseread function in the libsolv library is related to pointer arithmetic errors. Exploiting this vulnerability could allow a remote attacker to cause service failures...

The vulnerability of the Active Management Technology remote access implementation lies in insufficient validation of input data, allowing a perpetrator to trigger a service failure.

The vulnerability of the Active Management Technology remote access implementation is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the SAP Fiori Client’s mobile execution environment, related to insufficient validation of input data, allows a perpetrator to trigger a service failure.

The vulnerability of the SAP Fiori Client mobile environment is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending empty push notifications remotely...

openSUSE Security Update : mailman (openSUSE-2019-495)

This update for mailman to version 2.1.27 fixes the following issues : This security issue was fixed : - CVE-2018-0618: Additional protections against injecting scripts into listinfo and error messages pages bsc1099510. These non-security issues were fixed : - The hash generated when...

The vulnerability of the HECI subsystem of the microprogramming software for Intel Server Platform Services allows a perpetrator to cause a service failure.

The vulnerability of the HECI subsystem of the microprogramming software for Intel Server Platform Services SPS is related to insufficient verification of input data. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the TIFFWriteDirectorySec() function in the LibTIFF library, which allows a hacker to cause a service failure.

The vulnerability of the TIFFWriteDirectorySec function tifdirwrite.c in the LibTIFF library is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures using a specially crafted file...

The vulnerability of the Nginx Unit application server arises from overflow in the dynamic memory buffer, allowing attackers to cause service failures.

The vulnerability of the Nginx Unit application server arises from overflowing buffers in dynamic memory. Exploiting this vulnerability allows a malicious actor to cause service failures through a specially crafted request...

The vulnerabilities of the microprogrammed software of Moxa EDS-405A, Moxa EDS-408A, and Moxa EDS-510A allow a hacker to trigger a service failure.

The vulnerability of the microprogramming software of Moxa EDS-405A, Moxa EDS-408A, and Moxa EDS-510A devices is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures using a specially created...

The vulnerability of the Cisco Fabric Services component for NX-OS operating systems on Cisco devices allows a hacker to trigger a service failure.

The vulnerability of the Cisco Fabric Services component for NX-OS operating systems on Cisco devices exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

The vulnerability of the snprintf function in the file system GlusterFS allows a attacker to cause a service failure.

The vulnerability of the snprintf function in the GlusterFS file system is related to the use of an uncontrolled format string. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures...

CVE-2017-2659

It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts...