[ASA-201807-6] lib32-libcurl-compat: arbitrary code execution

Arch Linux Security Advisory ASA-201807-6 ========================================= Severity: High Date : 2018-07-16 CVE-ID : CVE-2018-0500 Package : lib32-libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-731 Summary ======= The package...

EulerOS 2.0 SP3 : shadow-utils (EulerOS-SA-2018-1169)

According to the version of the shadow-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A buffer overflow flaw leading to heap memory corruption was found in the shadow-utils's newusers utility. A local, authenticated attacker cou...

UBUNTU-CVE-2018-1000204

Linux Kernel version 3.18 to 4.16 incorrectly handles an SGIO ioctl on /dev/sg0 with dxferdirection=SGDXFERFROMDEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in...

CURL-CVE-2018-1000300 FTP shutdown response buffer overflow

curl might overflow a heap based memory buffer when closing down an FTP connection with long server command replies. When doing FTP transfers, curl keeps a spare "closure handle" around internally that is used when an FTP connection gets shut down since the original curl easy handle is then alrea...

CVE-2017-2591

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniquenessentrytoconfig function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap...

DEBIAN-CVE-2017-2591

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniquenessentrytoconfig function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap...

CVE-2017-2591

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniquenessentrytoconfig function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap...

Design/Logic Flaw

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniquenessentrytoconfig function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap...

CVE-2017-2591

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniquenessentrytoconfig function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap...

CVE-2017-2591

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniquenessentrytoconfig function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap...

CVE-2017-2591

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniquenessentrytoconfig function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap...

CVE-2017-2591

CVE-2017-2591 affects 389-ds-base prior to 1.3.6. The vulnerability arises from an improperly NULL terminated array in the uniqueness_entry_to_config() function of the attribute uniqueness plugin, enabling an attacker (authenticated or possibly unauthenticated) to trigger an out-of-bounds heap re...

OpenSLP Heap Memory Corruption - US

Lenovo Security Advisory: LEN-18247 Potential Impact: Denial of service, other undefined behavior Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2017-17833 Summary Description: OpenSLP versions used in several Lenovo products are vulnerable to heap memory corruption, potentiall...

Debian DLA-1364-1 : openslp-dfsg security update

CVE-2017-17833 An issue has been found in openslp that is related to heap memory corruption, which may result in a denial of service or remote code execution. For Debian 7 'Wheezy', these problems have been fixed in version 1.2.1-9+deb7u2. We recommend that you upgrade your openslp-dfsg packages...

[SECURITY] [DLA 1364-1] openslp-dfsg security update

Package : openslp-dfsg Version : 1.2.1-9+deb7u2 CVE ID : CVE-2017-17833 CVE-2017-17833 An issue has been found in openslp that is related to heap memory corruption, which may result in a denial-of-service or remote code execution. For Debian 7 "Wheezy", these problems have been fixed in version...

Node.js: Use After Free in crypto.randomFill

Summary: We can trigger Use-After-Free while running crypto.randomFill, so we can easily read/write heap memory using a typed array pointing a freed backing store. Description: See this nodecrypto.cc code. pp void RandomBytesBufferconst FunctionCallbackInfo& args ... char data = Buffer::Dataargs0...

Vulnerability Spotlight: Multiple Nvidia D3D10 Driver Pixel Shader Vulnerabilities

Discovered by Piotr Bania of Cisco Talos Overview Today, Cisco Talos is disclosing multiple vulnerabilities that exist within the Nvidia D3D10 driver. This driver is used throughout multiple GPU product lines available from Nvidia. This is a commonly used driver, and exploitation can even affect...

CVE-2018-8960

The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory allocation, leading to a heap-based buffer over-read...

RTSP RTP buffer over-read

curl can be tricked into copying data beyond end of its heap based buffer. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The memcpy call would copy data from the heap following the buffer to a storage area that would subsequently be...

ClamAV Out-of-Bounds Heap Memory Read Vulnerability

Clam AntiVirus ClamAV is an anti-virus package for use on UNIX-like systems. Mainly used in mail servers, using multi-threaded background operation, you can automatically upgrade the virus database. An out-of-bounds heap memory read vulnerability exists in the xarhashcheck function in the XAR...