Security Bulletin: CVE-2021-2161 may affect IBM® SDK, Java™ Technology Edition used by IBM Data Studio Client

Summary CVE-2021-2161 was disclosed in the Oracle April 2021 Patch Update. Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, high integrity...

The vulnerability of the sldns_str2wire_dname_buf_origin function in the DNS server Unbound allows a hacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the sldnsstr2wirednamebuforigin function in the DNS server’s Unbound component is related to integer overflow. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data, compromise its integrity, and cause service failures...

ALPINE-CVE-2021-3672

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as we...

xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality,...

Security Bulletin: A vulnerability in IBM Java SDK affects IBM Tivoli Netcool Impact (CVE-2021-2388, CVE-2021-2369, CVE-2021-2432)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Tivoli Netcool Impact. IBM Tivoli Netcool Impact has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-2388 DESCRIPTION: An unspecified vulnerability in Java SE related to the ...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. A security vulnerability exists in Huawei HarmonyOS, which provides a microkernel-based, fully-scoped distributed operating system. An attacker could exploit this vulnerability to cause an integrity impact...

flatpak: Sandbox bypass via recent VFS-manipulating syscalls

A flaw was found in the flatpak package. It is susceptible to a software flaw that can deceive portals and other host-OS services into treating the flatpak app as an ordinary, non-sandboxed host-OS process. This flaw allows the escalation of privileges that the corresponding services presume the...

The vulnerability of Google Chrome’s browser loading function, related to memory usage after it is released, allows a hacker to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of Google Chrome’s web browser loading function is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause service interruptions through a specially created...

The vulnerability of the TabGroups component in the Google Chrome web browser, related to memory usage after it is released, allows a malicious actor to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the TabGroups component in the Google Chrome web browser relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions through a specially...

The vulnerability of the PM_io_parser::readVertex() function in the Nef_2/PM_io parser component of the CGAL algorithm library allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the PMioparser::readVertex function in the Nef2/PMio parser component of the CGAL algorithm library is related to a polygon processing error in Nef. Exploiting this vulnerability could allow an attacker to access confidential data, compromise its integrity, and even cause...

flatpak: Sandbox bypass via recent VFS-manipulating syscalls

A flaw was found in the flatpak package. It is susceptible to a software flaw that can deceive portals and other host-OS services into treating the flatpak app as an ordinary, non-sandboxed host-OS process. This flaw allows the escalation of privileges that the corresponding services presume the...

The vulnerability of the Nef polygon function in the CGAL computational geometry algorithm library, which involves reading data beyond the permissible buffer limits, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Nef polygon function in the CGAL computational geometry algorithm library is related to reading data beyond the permissible buffer size. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause servi...

The vulnerability of the flatview_read_continue() module of the QEMU hardware emulation software lies in the ability to write beyond the buffer boundaries. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the flatviewreadcontinue module of the QEMU hardware emulation software is related to improper handling of write operations in the case of SDHCBLKSIZE. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause...

CVE-2021-35612

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2021-35640

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

CVE-2021-2485

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite component: Quotes. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management. Successful...

Design/Logic Flaw

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite component: View Reports. Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2021-35604

Removed by vendor...

CVE-2021-35604

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.35 and prior and 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2021-35602

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Options. Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...