485 matches found
OpenSSL: Fix memory issues in BIO_*printf functions
Several flaws were found in the way BIOprintf functions were implemented in OpenSSL. Applications which passed large amounts of untrusted data through these functions could crash or potentially execute code with the permissions of the user running such an application...
SUSE-SU-2016:1228-1 Security update for openssl
This update for openssl fixes the following issues: - CVE-2016-2108: Memory corruption in the ASN.1 encoder bsc977617 - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check bsc977616 - CVE-2016-2105: EVPEncodeUpdate overflow bsc977614 - CVE-2016-2106: EVPEncryptUpdate overflow bsc977615 -...
SUSE-SU-2016:0959-1 Security update for java-1_7_0-openjdk
The OpenJDK Java java-170-openjdk was updated to 2.6.5 to fix the following issues: Update to 2.6.5 - OpenJDK 7u99 bsc972468 Security fixes - S8152335, CVE-2016-0636: Improve MethodHandle consistency Import of OpenJDK 7 u99 build 0 - S6425769, PR2858: Allow specifying an address to bind JMX remot...
MGASA-2016-0121 Updated openafs packages fix security vulnerability
In OpenAFS before 1.6.17, users from foreign Kerberos realms can create groups as if they were administrators CVE-2016-2860. In OpenAFS before 1.6.17, information leakage over the network due to uninitialized memory CVE-2016-4536...
Vulnerability in OpenSSL - Fix memory issues in BIO_*printf functions
The internal |fmtstr| function used in processing a “%s” format string in the BIOprintf functions could overflow while calculating the length of a string and cause an OOB read when printing very long strings. Additionally the internal |doaproutch| function can attempt to write to an OOB memory...
Internet Bug Bounty: CVE-2016-0799 memory issues in BIO_*printf functions
https://github.com/openssl/openssl/commit/9cb177301fdab492e4cfef376b28339afe3ef663...
Scientific Linux Security Update : glibc on SL7.x x86_64 (20160216)
A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, potentially, execute code with the permissions of the user running the library. Note...
SUSE-SU-2016:0284-1 Security update for php5
This update for php5 fixes the following issues: - CVE-2015-7803: Specially crafted .phar files with a crafted TAR archive entry allowed remote attackers to cause a Denial of Service DoS bsc949961 - CVE-2016-1903: Specially crafted image files could could allow remote attackers read unspecified...
MGASA-2015-0469 Updated libraw packages fix security vulnerabilities
Updated libraw packages fix security vulnerabilities: It was found that smaldecodesegment function do not handle index carefully, which may cause index overflow CVE-2015-8366. It was found that phaseonecorrect function does not handle memory object's initialization correctly, which may have...
The vulnerabilities of Adobe Integrated Runtime and Flash Player software allow a perpetrator to execute arbitrary code.
The vulnerability of Adobe Integrated Runtime and Flash Player programs is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by using the LoadSound function...
SUSE-SU-2015:0868-1 Security update for php5
PHP was updated to fix ten security issues. The following vulnerabilities were fixed: CVE-2014-9709: A specially crafted GIF file could cause a buffer read overflow in php-gd bnc923946 CVE-2015-2301: Memory was use after it was freed in PHAR bnc922022 CVE-2015-2305: heap overflow vulnerability in...
USN-2570-1: Oxide vulnerabilities
An issue was discovered in the HTML parser in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. CVE-2015-1235 An issue was discovered in the Web Audio API implementation in Blink. If a user were...
CVE-2014-9718
The 1 BMDMA and 2 AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service memory consumption or infinite loop, and system crash via a PRDT with zero complete...
Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2519-1)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2519-1 advisory. Arnaud Le Blanc discovered that the GNU C Library incorrectly handled file descriptors when resolving DNS queries under high load. This may cause a denia...
MGASA-2015-0068 Updated patch packages fix security vulnerabilities
Updated patch package fixes security vulnerabilities: It was reported that a crafted diff file can make patch eat memory and later segfault CVE-2014-9637. It was reported that the versions of the patch utility that support Git-style patches are vulnerable to a directory traversal flaw. This could...
FreeBSD : PostgreSQL -- multiple buffer overflows and memory issues (3b40bf2c-ad83-11e4-a2b2-0026551a22dc)
PostgreSQL Project reports : This update fixes multiple security issues reported in PostgreSQL over the past few months. All of these issues require prior authentication, and some require additional conditions, and as such are not considered generally urgent. However, users should examine the lis...
PostgreSQL -- multiple buffer overflows and memory issues
PostgreSQL Project reports: This update fixes multiple security issues reported in PostgreSQL over the past few months. All of these issues require prior authentication, and some require additional conditions, and as such are not considered generally urgent. However, users should examine the list...
USN-2345-1 oxide-qt vulnerabilities
Multiple use-after-free issues were discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process...
Adobe Flash Player security update September 2014
Adobe today released an updated Flash Player that patched a dozen vulnerabilities, and also announced that a scheduled security update for Reader and Acrobat has been postponed to the week of Sept. 15. Today’s release, which coincides with Microsoft’s monthly scheduled security updates, patches...