SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:3191-1)

This update for ImageMagick fixes the following issues : Security issues fixed : CVE-2018-18024: Fixed an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. bsc1111069...

Wireshark 2.6.x < 2.6.4 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 2.6.4. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.6.4 advisory. - In Wireshark 2.6.0 to 2.6.3, the Steam IHS Discovery dissector could consume system memory. This was addressed i...

CVE-2018-3183

CVE-2018-3183 affects OpenJDK/OpenJDK-based runtimes (Java SE/Java SE Embedded/JRockit) specifically the Scripting engine. Public records in connected advisories show affected OpenJDK versions including Java 8u182 and 11 (and 8u181 for embedded/JRockit R28.3.19). The underlying issue is a scripti...

CVE-2018-2887

CVE-2018-2887 affects the MICROS Retail-J component of Oracle Retail Applications (subcomponent: Back Office). Affected versions are 13.0.0 and 12.1.2 . The vulnerability permits an unauthenticated attacker with network access over HTTP to compromise MICROS Retail-J, potentially leading to unauth...

CVE-2018-3204

CVE-2018-3204 affects Oracle Fusion Middleware’s Oracle BI Enterprise Edition Analytics Server (subcomponent) in the 12.2.1.3.0 release. An unauthenticated attacker with network access over HTTP can compromise data; user interaction is required. CVSS v3.0 base score is 8.2 (High). The vulnerabili...

How to build your own motion-activated security camera

Attention makers! Are you looking for a challenging project that not only gets your gears grinding but helps to keep you secure while traveling? Welcome to the build-your-own security camera tutorial. The impetus for this project originated from events that took place at Defcon 26, where hotel...

Solaris 10 (sparc) : 152920-11

JavaSE 6: update 211 patch equivalent to JDK 6u211, 64bit. Date this patch was last updated by Sun : Oct/15/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid118132;...

Solaris 10 (sparc) : 152100-91

JavaSE 8: update 191 patch equivalent to. Date this patch was last updated by Sun : Oct/15/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid118129; scriptversion"1.4";...

Debian DLA-1544-1 : tomcat7 security update

Sergey Bobrov discovered that when the default servlet returned a redirect to a directory e.g. redirecting to /foo/ when the user requested /foo a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. For Debian 8 'Jessie', this problem has...

Fedora 27 : libgit2 (2018-7d993184f6)

Update to 0.26.7 CVE-2018-17456 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

Fedora 27 : python-paramiko (2018-aff51f5e62)

Python Paramiko versions 2.3.2 and 2.4.1 are vulnerable to an authentication bypass in paramiko/authhandler.py. A remote attacker could exploit this vulnerability in Paramiko SSH servers to execute arbitrary code. Note that applications using Paramiko only as a client such as ansible are not...

Security in a World of Physically Capable Computers

It's no secret that computers are insecure. Stories like the recent Facebook hack, the Equifax hack and the hacking of government agencies are remarkable for how unremarkable they really are. They might make headlines for a few days, but they're just the newsworthy tip of a very large iceberg. Th...

Moderate: Red Hat Security Advisory: nss security update

An update for nss is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

nss: ServerHello.random is all zeros when handling a v2-compatible ClientHello

A flaw was found in the way NSS responded to an SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. A man-in-the-middle attacker could use this flaw in a passive replay attack...

Fedora 27 : mediawiki (2018-edf90410ea)

https://www.mediawiki.org/wiki/Releasenotes/1.29MediaWiki1.29.3 - T169545, CVE-2018-0503 SECURITY: $wgRateLimits entry for 'user' overrides 'newbie'. - T194605, CVE-2018-0505 SECURITY: BotPasswords can bypass CentralAuth's account lock. - T180551 Fix LanguageSrTest for language converter - T18055...

Microsoft Windows Graphics Component CVE-2018-8427 Information Disclosure Vulnerability

Description Microsoft Windows is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Technologies Affected Microsoft Excel Viewer 2007 Service Pack 3 Microsoft Office 2016 for Mac Microsoft...

Fedora 27 : liblouis (2018-9a09435935)

Security fix for CVE-2018-17294 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

CVE-2018-5401

The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The devices transmit process control information via unencrypted Modbus communications. Impact: A...

Network Security Monitoring vs Supply Chain Backdoors

On October 4, 2018, Bloomberg published a story titled “The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies,” with a subtitle “The attack by Chinese spies reached almost 30 U.S. companies, including Amazon and Apple, by compromising America’s technology supply chain, according t...

Sony Smart TV Bug Allows Remote Access, Root Privileges

As the number of smart TVs grows, so does the number of vulnerabilities inside of them. On Thursday, security researchers revealed that eight Sony Bravia smart TV models are vulnerable to three separate bugs, one rated critical. The flaws – a stack buffer overflow, a directory traversal and a...