Fedora 29 : 2:qemu / libvirt (2019-0332a96d31) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

Define md-clear CPUID bit. Assuming an updated host kernel and microcode, the md-clear bit will be automatically exposed to guests using the QEMU '-cpu host' arg, or libvirt 'host-model' or 'host-passthrough' configurations. Guests using a named CPU model it must be manually updated to add this...

Fedora 30 : 2:qemu / libvirt (2019-f910d35647) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

Define md-clear CPUID bit. Assuming an updated host kernel and microcode, the md-clear bit will be automatically exposed to guests using the QEMU '-cpu host' arg, or libvirt 'host-model' or 'host-passthrough' configurations. Guests using a named CPU model it must be manually updated to add this...

SUSE-SU-2019:1243-1 Security update for qemu

This update for qemu fixes the following issues: - CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091: Added x86 cpu feature 'md-clear' bsc1111331...

kernel security and bug fix update

3.10.0-957.12.1.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey bug 24817676 3.10.0-957.12.1 - kernel locking/rwsem: Fix possible missed wakeup Waiman Long 1690323...

Node.js third-party modules: [md-fileserver] Path Traversal

I would like to report path traversal in md-fileserver modulee It allows an attacker to read system files via path traversal through commandline Module module name: md-fileserver version: 1.3.2 npm page: https://www.npmjs.com/package/md-fileserver Module Description Starts a local server to rende...

kernel security, bug fix, and enhancement update

3.10.0-957.10.1.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey bug 24817676 3.10.0-957.10.1 - fs revert 'fs nfs: Don't write back further requests if there is a...

openSUSE Security Update : the Linux Kernel (openSUSE-2018-1549)

The openSUSE Leap 42.3 kernel was updated to 4.4.165-81.1 to receive various bugfixes. The following non-security bugs were fixed : - 9p locks: fix glock.clientid leak in dolock bnc1012382. - 9p: clear dangling pointers in p9statfree bnc1012382. - ACPI / LPSS: Add alternative ACPI HIDs for Cherry...

Security update for the Linux Kernel (important)

The openSUSE Leap 42.3 kernel was updated to 4.4.165-81.1 to receive various bugfixes. The following non-security bugs were fixed: - 9p locks: fix glock.clientid leak in dolock bnc1012382. - 9p: clear dangling pointers in p9statfree bnc1012382. - ACPI / LPSS: Add alternative ACPI HIDs for Cherry...

Cross-Site Scripting

Overview All versions of md-data-table are vulnerable to cross-site scripting XSS. This vulnerability is exploitable if an attacker has control over data that is rendered by mdt-row Recommendation As there is no fix for this vulnerability at this time we recommend either selecting another package...

Unbreakable Enterprise kernel security update

4.1.12-124.23.1 - xfs: don't call xfsdashrinkinode with NULL bp Eric Sandeen Orabug: 28898616 CVE-2018-13094 - ALSA: rawmidi: Change resized buffers atomically Takashi Iwai Orabug: 28898636 CVE-2018-10902 - md/raid5: fix a race condition in stripe batch Shaohua Li Orabug: 28917012 - xfs: don't fa...

CVE-2018-18587

BigProf AppGini 5.70 stores the passwords in the database using the MD5 hash...

Unbreakable Enterprise kernel security update

4.1.12-124.18.9 - rebuild bumping release 4.1.12-124.18.8 - Cipso: cipsov4optptr enter infinite loop yujuan.qi Orabug: 28563992 CVE-2018-10938 - Btrfs: fix listadd corruption and soft lockups in fsync Liu Bo Orabug: 28119834 - x86/paravirt: Fix spectre-v2 mitigations for paravirt guests Peter...

md-biro.hr XSS vulnerability

Open Bug Bounty ID: OBB-649961 Description| Value ---|--- Affected Website:| md-biro.hr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

DEBIAN-CVE-2018-8011

By specially crafting HTTP requests, the modmd challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 Affected 2.4.33...

md4c denial of service vulnerability

md4c is a C-based Markdown a markup language parser . A security vulnerability exists in the 'mdbuildattribute' function of the md4c.c file in versions of md4c prior to 0.2.6. A remote attacker can exploit this vulnerability to cause a denial of service segmentation error and application crash wi...

PT-2018-11015

Name of the Vulnerable Software and Affected Versions md4c version 0.2.6 Description The issue is related to a NULL pointer dereference in the md process line function in md4c.c. This occurs due to ctx-current block. Recommendations For md4c version 0.2.6, consider applying a patch to fix the NUL...

PT-2018-11022

Name of the Vulnerable Software and Affected Versions md4c version 0.2.6 Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault and application crash, or possibly have other unspecified impacts via a crafted file. This is due to the md build...

PT-2018-10654

Name of the Vulnerable Software and Affected Versions md4c version 0.2.5 Description The issue arises from a heap-based buffer over-read in the md is link reference definition helper function within md4c. This occurs due to md is link label mishandling loop termination, leading to improper handli...

PT-2018-10652

Name of the Vulnerable Software and Affected Versions md4c version 0.2.5 Description The issue is related to a heap-based buffer overflow in the md merge lines function. This overflow occurs because the md is link label function mishandles link labels composed solely of backslash escapes...

PT-2018-10653

Name of the Vulnerable Software and Affected Versions md4c version 0.2.5 Description The issue is caused by a heap-based buffer over-read due to an off-by-one error in the md is named entity contents function. Recommendations For md4c version 0.2.5, at the moment, there is no information about a...