Security Bulletin: CICS Transaction Gateway for Multiplatforms

Summary Multiple security vulnerablilities exist in the JREs shipped with CICS TG for client applications. CICS TG itself is not vulnerable to all these risks but client side applications using the CICS TG supplied JREs might be. Vulnerability Details CVEID: CVE-2016-0494 DESCRIPTION: An...

CVE-2016-10424

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 820, SD 820A, SD 835, S...

Code injection

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 820, SD 820A, SD 835, S...

CVE-2016-10424

CVE-2016-10424 concerns an issue in the LibPNG library used on Android devices. The provided records show that, for affected Android builds, upgrading LibPNG from 1.6.12 to 1.6.21 fixes multiple issues described by different CWEs. The Android CVE entry ties the vulnerability to the need for a pat...

Solaris 10 (sparc) : 137080-07

SunOS 5.10: libpng Patch. Date this patch was last updated by Sun : Jul/18/12 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Solaris 10 (sparc) : 137080-09

SunOS 5.10: libpng Patch. Date this patch was last updated by Sun : Jun/15/17 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Solaris 10 (x86) : 137081-09

SunOS 5.10x86: libpng Patch. Date this patch was last updated by Sun : Jun/15/17 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Solaris 10 (sparc) : 137080-10

SunOS 5.10: libpng Patch. Date this patch was last updated by Sun : Jul/17/17 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Solaris 10 (x86) : 137081-10

SunOS 5.10x86: libpng Patch. Date this patch was last updated by Sun : Jul/17/17 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Solaris 10 (x86) : 137081-07

SunOS 5.10x86: libpng Patch. Date this patch was last updated by Sun : Jul/18/12 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

VMware VNC Pointer Decode Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the remote management functionality of VMware . A specially crafted set of VNC packets can cause a type confusion resulting in stack overwrite, which could lead to code execution. An attacker can initiate a VNC session to trigger this...

libpng: Heap-buffer-overflow in OSS_FUZZ_png_combine_row

Project: https://github.com/glennrp/libpng.git Detailed report: https://oss-fuzz.com/testcase?key=5466114885681152 Project: libpng Fuzzer: libFuzzerlibpngreadfuzzer Fuzz target binary: libpngreadfuzzer Job Type: libfuzzerasanlibpng Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

libpng: Heap-buffer-overflow in OSS_FUZZ_png_combine_row

Detailed report: https://oss-fuzz.com/testcase?key=4838858534420480 Project: libpng Fuzzer: afllibpngreadfuzzer Fuzz target binary: libpngreadfuzzer Job Type: aflasanlibpng Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x608000000080 Crash State: OSSFUZZpngcombinerow...

Fedora 26 : gd (2017-7cc0e6a5f5)

Version 2.2.5 - 2017-08-30 - Security - Double-free in gdImagePngPtr. CVE-2017-6362 - Buffer over-read into uninitialized memory. CVE-2017-7890 - Fixed - Fix 109: XBM reading fails with printed error - Fix 338: Fatal and normal libjpeg/ibpng errors not distinguishable - Fix 357: 2.2.4: Segfault i...

SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:2175-1)

This java-180-openjdk update to version jdk8u141 icedtea 3.5.0 fixes the following issues: Security issues fixed : - CVE-2017-10053: Improved image post-processing steps bsc1049305 - CVE-2017-10067: Additional jar validation steps bsc1049306 - CVE-2017-10074: Image conversion improvements...

[SECURITY] Fedora 25 Update: libpng15-1.5.28-1.fc25

The libpng15 package provides libpng 1.5, an older version of the libpng. library for manipulating PNG Portable Network Graphics image format files. This version should be used only if you are unable to use the current version of libpng...

Denial-of-Service (DoS) Via Embedded Dependency

lwip embeds a copy of libpng version 1.6.18 as a dependency. This version of libpng is vulnerable to multiple denial-of-service DoS vulnerabilities including CVE-2015-8126, and CVE-2015-8472...

Buffer Overflow

libpng is vulnerable to buffer overflows. A malicious user can pass a malicious png file to the system to cause buffer overflows that can lead to the system crashing or other kinds of impacts on the system...

Buffer Overflow

libpng is vulnerable to buffer overflows. A malicious user can pass a malicious png file to the system to cause an out-of-bounds read that can lead to the system crashing...

Denial Of Service (DoS) Through A Null Pointer Dereference

libpng is vulnerable to denial of service DoS attacks via null pointer dereference. The vulnerability has existed in libpng since version 0.71. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png...