Microsoft Excel 2010 Service Pack 2 Multiple Vulnerabilities (KB4475574)

This host is missing an important security update according to Microsoft KB4475574 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Microsoft Excel 2013 Service Pack 1 Multiple Vulnerabilities (KB4475566)

This host is missing an important security update according to Microsoft KB4475566 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Security Update for Microsoft Office (September 2019) (macOS)

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability exists in Microsoft Excel due to improper disclosure of contents in memory. An...

OPENSUSE-SU-2019:2120-1 Security update for nginx

This update for nginx fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization bsc1145579. - CVE-2019-9513: Fixed a denial of service caused by resource loops bsc1145580. - CVE-2019-9516: Fixed a denial...

DirectWrite Information Disclosure Vulnerability

An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. There are multiple ways an attacker could exploit the...

Security update for nginx (important)

openSUSE Security Update: Security update for nginx Announcement ID: openSUSE-SU-2019:2120-1 Rating: important References: 1115015 1115022 1115025 1145579 1145580 1145582 Cross-References: CVE-2018-16843 CVE-2018-16844 CVE-2018-16845 CVE-2019-9511 CVE-2019-9513 CVE-2019-9516 Affected Products:...

Facebook Patches "Memory Disclosure Using JPEG Images" Flaws in HHVM Servers

Facebook has patched two high-severity vulnerabilities in its server application that could have allowed remote attackers to unauthorisedly obtain sensitive information or cause a denial of service just by uploading a maliciously constructed JPEG image file. The vulnerabilities reside in HHVMHipH...

Facebook Patches "Memory Disclosure Using JPEG Images" Flaws in HHVM Servers

Facebook has patched two high-severity vulnerabilities in its server application that could have allowed remote attackers to unauthorisedly obtain sensitive information or cause a denial of service just by uploading a maliciously constructed JPEG image file. The vulnerabilities reside in HHVM...

libhevc:hevc_dec_fuzzer: Use-of-uninitialized-value in ihevcd_fmt_conv_420sp_to_rgb565

Detailed Report: https://oss-fuzz.com/testcase?key=5728697516032000 Project: libhevc Fuzzing Engine: libFuzzer Fuzz Target: hevcdecfuzzer Job Type: libfuzzermsanlibhevc Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: ihevcdfmtconv420sptorgb565 ihevcdfmtconv...

SUSE SLES15 Security Update : nginx (SUSE-SU-2019:2309-1) (0-Length Headers Leak) (Data Dribble) (Resource Loop)

This update for nginx fixes the following issues : Security issues fixed : CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization bsc1145579. CVE-2019-9513: Fixed a denial of service caused by resource loops bsc1145580. CVE-2019-9516: Fixed a denial of...

SUSE-SU-2019:2309-1 Security update for nginx

This update for nginx fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization bsc1145579. - CVE-2019-9513: Fixed a denial of service caused by resource loops bsc1145580. - CVE-2019-9516: Fixed a denial...

Amazon Linux 2 : ruby (ALAS-2019-1276)

It was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory. CVE-2018-8777 It wa...

Unspecified vulnerability in Linux kernel (CNVD-2019-38268)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the drivers/scsi/aacraid/commctrl.c file in versions of the Linux kernel prior to 4.13, which stems from the structure of...

USN-4105-1: CUPS vulnerabilities

Stephan Zeisberg discovered that the CUPS SNMP backend incorrectly handled encoded ASN.1 inputs. A remote attacker could possibly use this issue to cause CUPS to crash by providing specially crafted network traffic. CVE-2019-8696, CVE-2019-8675 It was discovered that CUPS did not properly handle...

openSUSE Security Update : the Linux Kernel (openSUSE-2019-1924)

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2019-1125: Fix Spectre V1 variant memory disclosure by speculation over the SWAPGS instruction bsc1139358. - CVE-2019-10207: A NULL pointer dereference was possible i...

Ubuntu 16.04 LTS / 18.04 LTS : CUPS vulnerabilities (USN-4105-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4105-1 advisory. StephanZeisbergdiscovered that the CUPS SNMP backend incorrectly handled encoded ASN.1 inputs. A remote attacker could possibly use this issu...

FreeBSD-SA-19:23.midi

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:23.midi Security Advisory The FreeBSD Project Topic: kernel memory disclosure from /dev/midistat Category: core Module: sound Announced: 2019-08-20 Credits:...

FreeBSD -- kernel memory disclosure from /dev/midistat

Problem Description: The kernel driver for /dev/midistat implements a handler for read2. This handler is not thread-safe, and a multi-threaded program can exploit races in the handler to cause it to copy out kernel memory outside the boundaries of midistat's data buffer. Impact: The races allow a...

php: Heap-based buffer over-read in PHAR reading functions

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the...

OPENSUSE-SU-2019:1924-1 Security update for the Linux Kernel

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-1125: Fix Spectre V1 variant memory disclosure by speculation over the SWAPGS instruction bsc1139358. - CVE-2019-10207: A NULL pointer dereference was possible in...