Design/Logic Flaw

In lib/ofp-util.c in Open vSwitch OvS before 2.8.1, there are multiple memory leaks while parsing malformed OpenFlow group mod messages. NOTE: the vendor disputes the relevance of this report, stating "it can only be triggered by an OpenFlow controller, but OpenFlow controllers have much more...

CVE-2017-14970

In lib/ofp-util.c in Open vSwitch OvS before 2.8.1, there are multiple memory leaks while parsing malformed OpenFlow group mod messages. NOTE: the vendor disputes the relevance of this report, stating "it can only be triggered by an OpenFlow controller, but OpenFlow controllers have much more...

CVE-2017-14970

In lib/ofp-util.c in Open vSwitch OvS before 2.8.1, there are multiple memory leaks while parsing malformed OpenFlow group mod messages. NOTE: the vendor disputes the relevance of this report, stating "it can only be triggered by an OpenFlow controller, but OpenFlow controllers have much more...

CVE-2017-14970

Open vSwitch contains CVE-2017-14970: memory leaks in lib/ofp-util.c when parsing malformed OpenFlow group mod messages. Documentation across multiple sources confirms affected product Open vSwitch, with fixes implemented in Open vSwitch 2.8.1 (or newer per update advisories). The vendor dispute ...

CVE-2017-14970

In lib/ofp-util.c in Open vSwitch OvS before 2.8.1, there are multiple memory leaks while parsing malformed OpenFlow group mod messages. NOTE: the vendor disputes the relevance of this report, stating "it can only be triggered by an OpenFlow controller, but OpenFlow controllers have much more...

Chris Vickery on Amazon S3 Data Leaks

Mike Mimoso talks to Chris Vickery of UpGuard of the recent rash of Amazon S3 data leaks. Vickery uncovers of the commonalities among these leaks, some of which include AWS misconfigurations and mismanagement of third-party partner relationships. Download: ChrisVickeryonAmazonS3DataLeaks.mp3...

Debian DSA-3981-1 : linux - security update (BlueBorne) (Stack Clash)

Several vulnerabilities have been discovered in the Linux kernel that may lead to privilege escalation, denial of service or information leaks. - CVE-2017-7518 Andy Lutomirski discovered that KVM is prone to an incorrect debug exception DB error occurring while emulating a syscall instruction. A...

Debian DLA-1099-1 : linux security update (BlueBorne) (Stack Clash)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2017-7482 Shi Lei discovered that RxRPC Kerberos 5 ticket handling code does not properly verify metadata, leading to information disclosure, denia...

[SECURITY] [DSA 3981-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3981-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 20, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 1099-1] linux security update

Package : linux Version : 3.2.93-1 CVE ID : CVE-2017-7482 CVE-2017-7542 CVE-2017-7889 CVE-2017-10661 CVE-2017-10911 CVE-2017-11176 CVE-2017-11600 CVE-2017-12134 CVE-2017-12153 CVE-2017-12154 CVE-2017-14106 CVE-2017-14140 CVE-2017-14156 CVE-2017-14340 CVE-2017-14489 CVE-2017-1000111 CVE-2017-10002...

Design/Logic Flaw

The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to download any files and cause information leaks such as system configuration...

CVE-2017-10931

The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to download any files and cause information leaks such as system configuration...

Risks Limited With Latest Apache Bug, Optionsbleed

Servers running Apache software are susceptible to memory leaks that an attacker could theoretically piece together to learn secrets transmitted during a session. But the risk is most pressing only in shared hosting environments apparently, and only if the software is running a certain rare...

CVE-2017-7441

In Sophos SurfRight HitmanPro before 3.7.20 Build 286 included in the HitmanPro.Alert solution and Sophos Clean, a crafted IOCTL with code 0x22E1C0 might lead to kernel data leaks. Because the leak occurs at the driver level, an attacker can use this vulnerability to leak some critical informatio...

Design/Logic Flaw

In Sophos SurfRight HitmanPro before 3.7.20 Build 286 included in the HitmanPro.Alert solution and Sophos Clean, a crafted IOCTL with code 0x22E1C0 might lead to kernel data leaks. Because the leak occurs at the driver level, an attacker can use this vulnerability to leak some critical informatio...

Debian DSA-3969-1 : xen - security update

Multiple vulnerabilities have been discovered in the Xen hypervisor : - CVE-2017-10912 Jann Horn discovered that incorrectly handling of page transfers might result in privilege escalation. - CVE-2017-10913 / CVE-2017-10914 Jann Horn discovered that race conditions in grant handling might result ...

[SECURITY] [DSA 3969-1] xen security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3969-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 12, 2017 https://www.debian.org/security/faq -...

Google Android Qualcomm WLAN Driver Competitive Conditions Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handset Alliance OHA, of which Qualcomm WLAN driver is a wireless driver. A competitive condition vulnerability exists in the Qualcomm WLAN driver in Android. An attacker could exploit this vulnerabilit...

kernel: Memory leaks in xfs_attr_list.c error paths

A flaw was found in the Linux kernel's implementation of XFS file attributes. Two memory leaks were detected in xfsattrshortformlist and xfsattr3leaflistint when running a docker container backed by xfs/overlay2. A dedicated attacker could possible exhaust all memory and create a denial of servic...

SUSE SLES11 Security Update : xen (SUSE-SU-2017:2339-1)

This update for xen fixes the following issues : - CVE-2017-12855: Premature clearing of GTFwriting / GTFreading lead to potentially leaking sensitive information XSA-230, bsc1052686. - CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious guest to crash the host or...