SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2019:0678-1)

This update for openssl-11 OpenSSL Security Advisory 6 March 2019 fixes the following issues : Security issue fixed : CVE-2019-1543: Fixed an implementation error in ChaCha20-Poly1305 where it was allowed to set IV with more than 12 bytes bsc1128189. Other issues addressed: Fixed a segfault in...

McAfee Network Security Manager Elevation of Privilege Vulnerability

McAfee Network Security Manager NSM is a network security solution from McAfee that enables real-time monitoring of deployed McAfee intrusion prevention systems across the network. A security vulnerability exists in McAfee Network Security Manager. An attacker could exploit this vulnerability to...

Debian DLA-1725-1 : rsync security update

Trail of Bits used the automated vulnerability discovery tools developed for the DARPA Cyber Grand Challenge to audit zlib. As rsync, a fast, versatile, remote and local file-copying tool, uses an embedded copy of zlib, those issues are also present in rsync. CVE-2016-9840 In order to avoid...

Fedora 28 : wordpress (2019-8606c6da35)

Upstream announcement: WordPress 5.1.1 Security and Maintenance Release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introduci...

Fedora 28 : golang-googlecode-net (2019-07d447a1d3)

Bump to commit 16b79f2e4e95ea23b2bf9903c9809ff7b013ce85 Security fixes for CVE-2018-17143, CVE-2018-17142, CVE-2018-17075, CVE-2018-17846, CVE-2018-17847, CVE-2018-17848 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

SUSE SLED15 / SLES15 Security Update : libjpeg-turbo (SUSE-SU-2019:0711-1)

This update for libjpeg-turbo fixes the following issues : The following security vulnerabilities were addressed : CVE-2018-14498: Fixed a heap-based buffer over read in get8bitrow function which could allow to an attacker to cause denial of service bsc1128712. CVE-2018-11813: Fixed the end-of-fi...

Securing Your Direct Internet Access Connections

With the rapid uptake in SaaS applications and the ease of moving enterprise applications from the data center to the cloud, many global companies are transforming the way they connect branch offices. In the past, the conventional approach was to connect all of your locations over an MPLS Wide Ar...

Command injection

An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1TRUNK-20181105.bin. A shell command injection occurs by editing the description of an ISP file. The file network/isp/ispupdateedit.php does not properly validate user input, which leads to...

Are hackers gonna hack anymore? Not if we keep reusing passwords

Enterprises have a password problem, and it’s one that is making the work of hackers a lot easier. From credential stuffing to brute force and password spraying attacks, modern hackers don’t have to do much hacking in order to compromise internal corporate networks. Instead, they log in using wea...

CVE-2018-16563

Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays are affected by CVE-2018-16563 due to improper input validation. Specially crafted packets sent to TCP port 102 can cause a denial-of-service, requiring a manual restart to restore EN100 module functionality. Exploitation requires ...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0672-1)

This update for the Linux Kernel 3.12.74-6064104 fixes several issues. The following security issues were fixed : CVE-2019-9213: Expanddownwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP...

SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2019:0658-1)

This update for nodejs4 fixes the following issues : Security issues fixed : CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active bsc1127533. CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Servi...

Fedora 29 : python2-django1.11 (2019-f528d75a69)

Update to the 1.11.20 security fix release Fixes CVE-2019-6975: Memory exhaustion in django.utils.numberformat.format Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

Fedora 28 : SDL (2019-918aad6bd5)

This release fixes a buffer overflow when processing RIFF/WAV files with in invalid MS ADPCM predictor. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as mu...

Fedora 28 : ghostscript (2019-7b9bb0e426)

Security fix for CVE-2019-6116 - Fix for bug 1687144 added Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Post-Perimeter Security: Addressing Evolving Mobile Enterprise Threats

In the era of the cloud, enterprises house sensitive corporate data outside of the traditional perimeter; employees can access this from any endpoint, including mobile devices, and from any network. This presents a host of new challenges for companies looking to protect their sensitive informatio...

SUSE SLED15 / SLES15 Security Update : lftp (SUSE-SU-2019:0643-1)

This update for lftp fixes the following issues: Security issue fixed : CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system bsc1103367. Other issue addressed: The SSH login handling code detects password prompts more reliably...

SUSE SLED15 / SLES15 Security Update : go1.11 (SUSE-SU-2019:0651-1)

This update for go1.11 to version 1.11.5 fixes the following issues : Security issue fixed : CVE-2019-6486: Fixed a CPU Denial-of-Service vulnerability affecting crypto/ellpitic related to P-521 and P-384 bsc1123013 go29903. Other bug fixes and changes made: Fix erroneous trailing backslash in...

CUJO Smart Firewall mdnscap mDNS label compression denial-of-service vulnerability

Summary An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. When parsing labels in mDNS packets, the firewall unsafely handles label compression pointers, leading to an uncontrolled recursion that eventually exhausts the...

CUJO Smart Firewall mdnscap mDNS SRV record denial-of-service vulnerability

Summary An exploitable integer underflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall, version 7003. When parsing SRV records in an mDNS packet, the “RDLENGTH” value is handled incorrectly, leading to an out-of-bounds access that crashes the mdnscap process. An...