Microsoft Issues Patches for 3 Bugs Exploited as Zero-Day in the Wild

It's April 2020 Patch Tuesday , and during these challenging times of coronavirus pandemic, this month's patch management process would not go easy for many organizations where most of the resources are working remotely. Microsoft today released the latest batch of software security updates for a...

CVE-2020-10595

A flaw was found during prompting initiated by the Kerberos library, where an attacker who enters a response exactly as long as the length of the buffer provided by the underlying Kerberos library, causes pam-krb5 to write a single null byte past the end of that buffer. This flaw results in heap...

UBUNTU-CVE-2014-5012

DOMPDF before 0.6.2 allows denial of service...

PYSEC-2019-257

http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service crash due to a NULL pointer dereference by returning a crafted response that lacks a space character...

The vulnerability in the t1_lib.c file of the OpenSSL library allows a hacker to induce a service failure.

The vulnerability in the t1lib.c file of the OpenSSL library is related to resource management errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause a service failure by using large OCSP Status Request requests...

libssh2: Integer overflow in user authenticate keyboard interactive allows out-of-bounds writes

A flaw was found in libssh2. A server could send a multiple keyboard interactive response messages, whose total length are greater than the unsigned char max characters. This value is used as an index to copy memory causing in an out of bounds memory write error. The highest threat from this...

The vulnerability in the library of MSXML used by MatrikonOPC Explorer, a software tool for managing technological processes. This vulnerability allows an attacker to transfer data from the main system and gain access to confidential information.

The vulnerability of the MSXML library used in MatrikonOPC Explorer, a software tool for managing technological processes, is related to security flaws in its mechanisms. Exploiting this vulnerability could allow an attacker, operating locally, to transfer data from the main system and gain acces...

UBUNTU-CVE-2018-19608

Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption, which is used in RSA-without-ECDHE cipher suites...

UBUNTU-CVE-2018-16402

libelf/elfend.c in elfutils 0.173 allows remote attackers to cause a denial of service double free and application crash or possibly have unspecified other impact because it tries to decompress twice...

pcre: Invalid Unicode property lookup (8.41/7, 10.24/2)

libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service segmentation violation for read access, and application crash by triggering an invalid Unicode property lookup...

CVE-2018-11621

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

DEBIAN-CVE-2018-14453

An issue was discovered in libgig 4.1.0. There is a heap-based buffer overflow in pData1 access in the function store16 in helper.h...

CVE-2017-18103

The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remote attackers to spoof web content in the Mozilla Firefox Browser through uploaded files that have a content-type of application/mathml+xml...

CVE-2018-2942

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Windows DLL. Supported versions that are affected are Java SE: 7u181 and 8u172. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful...

ALPINE-CVE-2018-11439

The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file...

Microsoft Windows Remote Code Execution Vulnerability (CNVD-2018-08491)

Microsoft Windows 10 and others are a series of operating systems released by Microsoft Corporation.Microsoft Windows 10 is a set of operating systems for personal computers.Windows Server 2008 SP2 is a set of server operating systems. A remote code execution vulnerability exists in Microsoft...

The vulnerability of the aac library component of the Media Framework operating system in Android, which allows a hacker to trigger a service failure

The vulnerability of the aac library component of the Media Framework operating system in Android is related to insufficient state checking. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

PYSEC-2018-147

In Exiv2 0.26, the Exiv2::Internal::printCsLensFFFF function in canonmnint.cpp allows remote attackers to cause a denial of service invalid memory access via a crafted file...

DEBIAN-CVE-2018-7642

The swapstdrelocin function in aoutx.h in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service aout32swapstdrelocout NULL pointer dereference and application crash via a crafted ELF file, as demonstrated by...

ALPINE-CVE-2018-7569

dwarf2.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service integer underflow or overflow, and application crash via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm...