CVE-2019-17075

A denial of service DoS was found in the writetptentry in drivers/infiniband/hw/cxgb4/mem.c in the cxgb4' Chelsio T4/T5 RDMA Driver. Some of the architectures performing the DMA operation directly from the stack variable instead of the heap allows an attacker in the network to cause some security...

nss security update

CentOS Errata and Security Advisory CESA-2019:4190 An update for nss, nss-softokn, and nss-util is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...

Parental Controls – Trend Micro Home Network Security has got you covered

We continue our three-part series on protecting your home and family. If you missed our first part, you can find it here. Are your kids at that formative age when they’re beginning to use mobile devices? How about at that inquisitive age when they start to discover the wonders of the Internet? Or...

Fedora 31 : cacti / cacti-spine (2019-362f0e9710)

Update to 1.2.8 Release notes: https://www.cacti.net/releasenotes.php?version=1.2.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

EulerOS 2.0 SP5 : libgcrypt (EulerOS-SA-2019-2695)

According to the version of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate...

SUSE SLES12 Security Update : spectre-meltdown-checker (SUSE-SU-2019:3340-1)

This update for spectre-meltdown-checker fixes the following issues : version 0.43 - feat: implement TAA detection CVE-2019-11135 bsc1139073 - feat: implement MCEPSC / iTLB Multihit detection CVE-2018-12207 bsc1117665 - feat: taa: add TSXCTRL MSR detection in hardware info - feat: fwdb: use both...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2019:3337-1)

This update for MozillaFirefox fixes the following issues : Mozilla Firefox was updated to 68.3esr MFSA 2019-37 bsc1158328 Security issues fixed : CVE-2019-17008: Fixed a use-after-free in worker destruction bmo1546331 CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments ...

Trend Micro Apex Central CVE-2019-19692 Cross Site Scripting Vulnerability

Description Trend Micro Apex Central is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Thi...

IBM Cognos Analytics Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

Description IBM Cognos Analytics is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability. An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based...

SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2019:3338-1)

This update for xen fixes the following issues : CVE-2019-19581: Fixed a potential out of bounds on 32-bit Arm bsc1158003 XSA-307. CVE-2019-19582: Fixed a potential infinite loop when x86 accesses to bitmaps with a compile time known size of 64 bsc1158003 XSA-307. CVE-2019-19583: Fixed improper...

CVE-2019-11090

CVE-2019-11090 relates to cryptographic timing conditions in Intel components (CSME, SPS, TXE, AMT, PTT and DAL) that may allow an unauthenticated attacker to disclose information over the network. Affected are Intel CSME before 11.8.70/11.11.70/11.22.70 and 12.0.45; 13.0.0 and 14.0.10; Intel TXE...

CVE-2019-10487

CVE-2019-10487 affects Qualcomm Snapdragon family components (e.g., Snapdragon Auto/Compute/IoT lineups) and is caused by a buffer over-read while parsing SMS OTA messages at the transport layer when the network provides unintended values. The issue spans a wide set of Qualcomm/SC/MDM/SDA/SXR dev...

EulerOS 2.0 SP3 : squid (EulerOS-SA-2019-2666)

According to the version of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding featur...

EulerOS 2.0 SP3 : pcre (EulerOS-SA-2019-2646)

According to the versions of the pcre packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a...

EulerOS 2.0 SP3 : giflib (EulerOS-SA-2019-2587)

According to the versions of the giflib package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service program crash via crafted image an...

Fedora 31 : openslp (2019-1e5ae33e87)

Security fix for CVE-2019-5544 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Fedora 31 : xen (2019-6aad703290)

denial of service in findnextbit XSA-307, CVE-2019-19581, CVE-2019-19582 1782211 denial of service in HVM/PVH guest userspace code XSA-308, CVE-2019-19583 1782206 privilege escalation due to malicious PV guest XSA-309, CVE-2019-19578 1782210 Further issues with restartable PV type change operatio...

EulerOS 2.0 SP3 : tomcat (EulerOS-SA-2019-2675)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to...

SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2019:3318-1)

This update for samba fixes the following issues : CVE-2019-14861: Fixed a DNSServer RPC server crash, that allowed an authenticated user to crash the DCE/RPC DNS management server by creating records with matching the zone name bsc1158108. CVE-2019-14870: Fixed a DelegationNotAllowed not being...

EulerOS 2.0 SP3 : libpcap (EulerOS-SA-2019-2612)

According to the version of the libpcap package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.CVE-2019-15165 Note that Tenable...