OracleVM 3.4 : microcode_ctl (OVMSA-2018-0013) (Spectre)

The remote OracleVM system is missing necessary patches to address critical security updates : - Revert: early microcode load to allow updating Broadwell model 79 - Revert: Make sure 'modprobe microcode' is not executed on Broadwell model 79 - Revert: Run dracut upon microcode update - Revert...

Oracle Linux 7 : microcode_ctl (ELSA-2018-4018) (Spectre)

Description of changes: 2.1-22.5.0.3 - Revert Intel 20180108 microcode for CPUIDs: CVE-2017-5715 306c3 06-3c-03 rev 0x23, Haswell 306d4 06-3d-04 rev 0x28, Broadwell 306f2 06-3f-02 rev 0x3b, Haswell 306f4 06-3f-04 rev 0x10, Haswell 306e4 06-3e-04 rev 0x42a, Ivy Bridge 40651 06-45-01 rev 0x21,...

microcode_ctl security update

1:1.17-25.4.0.2 - Revert: early microcode load to allow updating Broadwell model 79 - Revert: Make sure 'modprobe microcode' is not executed on Broadwell model 79 - Revert: Run dracut upon microcode update - Revert updated Intel 20180108 microcode for CPUIDs: CVE-2017-5715 306c3 06-3c-03 rev 0x23...

Intel Says Firmware Fixes for Spectre and Meltdown Affecting Newer Chips

Intel’s efforts to issue fixes for the Spectre and Meltdown CPU vulnerabilities are still hitting some bumps in the road, a company executive said in a blog post. “We have now issued firmware updates for 90 percent of Intel CPUs introduced in the past five years, but we have more work to do,” sai...

APT Trends report Q3 2017

Introduction Beginning in the second quarter of 2017, Kaspersky's Global Research and Analysis Team GReAT began publishing summaries of the quarter's private threat intelligence reports in an effort to make the public aware of what research we have been conducting. This report serves as the next...

Memory Corruption Vulnerability in Pleasant Book PDF Reader

Yue Book PDF Reader is an e-book reader developed by Shenzhen Ivy Software Technology Co. YueShu PDF Reader suffers from a memory corruption vulnerability when processing PDF files. An attacker can cause the program to crash by constructing some malformed PDF files...

Fedora 26 : gsoap (2017-d2174c28ed) (Devil's Ivy)

Security fix for CVE-2017-9765. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

openSUSE Security Update : gsoap (openSUSE-2017-842) (Devil's Ivy)

This update for gsoap fixes the following security issue : - CVE-2017-9765: A remote attacker may have triggered a buffer overflow to cause a server crash denial of service after sending 2GB of a specially crafted XML message, or possibly have unspecified futher impact. bsc1049348 %NASLMINLEVEL...

CVE-2017-9765

Integer overflow in the soapget function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow and application crash via a large XML document, aka Devil'...

UBUNTU-CVE-2017-9765

Integer overflow in the soapget function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow and application crash via a large XML document, aka Devil'...

CVE-2017-9765

Integer overflow in the soapget function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow and application crash via a large XML document, aka Devil'...

CVE-2017-9765

The affected software is Genivia gSOAP (2.7.x and 2.8.x) with versions before 2.8.48. The underlying issue is an integer overflow in the soap_get function, allowing remote attackers to execute arbitrary code or cause a denial of service via a large XML document (Devil’s Ivy). Public disclosures a...

Genivia gSOAP Devil's Ivy Stack Buffer Overflow Vulnerability

gSOAP is a widely used Web services toolkit. Developers use gSOAP as part of a software stack that enables various devices to communicate with the Internet. Genivia gSOAP suffers from a Devil's Ivy stack buffer overflow vulnerability that allows an attacker to remotely corrupt the SOAP web servic...

CVE-2017-9765

Integer overflow in the soapget function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow and application crash via a large XML document, aka Devil'...

Devil's Ivy vulnerability(CVE-2017-9765)

When we began a security analysis of remote configuration services last year, we had no idea it would lead us to uncover vulnerabilities that affect so many users. We have been studying the prevalence and nature of the vulnerabilities that arise in remote configuration services, so when we...

AXIS gSOAP Message Handling RCE (ACV-116267) (Devil's Ivy)

The remote AXIS device is running a firmware version that is missing a security patch. It is, therefore, affected by a remote code execution vulnerability, known as Devil's Ivy, due to an overflow condition that exists in a third party SOAP library gSOAP. An unauthenticated, remote attacker can...

Axis Camera Multiple Products RCE (Devil's Ivy)

Binary data 7279.pasl...

Remotely Exploitable Flaw Puts Millions of Internet-Connected Devices at Risk

Security researchers have discovered a critical remotely exploitable vulnerability in an open-source software development library used by major manufacturers of the Internet-of-Thing devices that eventually left millions of devices vulnerable to hacking. The vulnerability CVE-2017-9765, discovere...

Spear Phishing Techniques Used in Attacks Targeting the Mongolian Government

Introduction FireEye recently observed a sophisticated campaign targeting individuals within the Mongolian government. Targeted individuals that enabled macros in a malicious Microsoft Word document may have been infected with Poison Ivy, a popular remote access tool RAT that has been used for...

Spear Phishing Techniques Used in Attacks Targeting the Mongolian Government

Introduction FireEye recently observed a sophisticated campaign targeting individuals within the Mongolian government. Targeted individuals that enabled macros in a malicious Microsoft Word document may have been infected with Poison Ivy, a popular remote access tool RAT that has been used for...