Debian DLA-1432-1 : gpac security update

Two heap buffer over read conditions were found in gpac. CVE-2018-13005 Due to an error in a while loop condition, the function urnRead in isomedia/boxcodebase.c has a heap-based buffer over-read. CVE-2018-13006 Due to an error in a strlen call, there is a heap-based buffer over-read in the...

Debian DLA-1431-1 : ant security update

unzip and untar target tasks in ant allows the extraction of files outside the target directory. A crafted zip or tar file submitted to an Ant build could create or overwrite arbitrary files with the privileges of the user running Ant. For Debian 8 'Jessie', these problems have been fixed in...

Slackware 14.0 / 14.1 / 14.2 / current : httpd (SSA:2018-199-01)

New httpd packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2018-199-01. The text itself is copyright C Slackware Linux...

How to block ads like a pro

In part one of this series, we had a look at a few reasons why you should be blocking online advertisements on your network and devices. From malvertising attacks and privacy-invading tracking systems to just being an outright annoyance, online ads and trackers are a nuisance that provides an...

LabCorp Investigates a Potential Breach that Could Affect Millions

U.S. health diagnostics giant LabCorp has revealed that it detected “suspicious activity” on its network this past weekend, which disrupted its ability to process medical tests. Patient access to testing results was also interrupted. In an SEC filing on Monday, the Fortune 500 company said that i...

CVE-2018-3018

CVE-2018-3018 affects the Oracle iStore component of Oracle E-Business Suite (Shopping Cart). Affected versions include 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7. The flaw is exploitable via unauthenticated network access over HTTP; attacks may require user interaction, a...

Iron Rain: Gaining Situational Intelligence to Make Rapid Decisions

In our previous article we introduced the idea of cyber insurgency and irregular warfare. Building on effective techniques from the Marine Corps, we now want to discuss combating the threat. COUNTERINSURGENT FORCES MUST UNDERSTAND THE ENVIRONMENT As destructive attacks surge, integrity attacks...

SUSE SLED12 / SLES12 Security Update : perl (SUSE-SU-2018:1972-1)

This update for perl fixes the following issues: These security issue were fixed : - CVE-2018-6913: Fixed space calculation issues in pppack.c bsc1082216. - CVE-2018-6798: Fixed heap buffer overflow in regexec.c bsc1082233. - CVE-2018-6797: Fixed sharp-s regexp overflow bsc1082234. -...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2018-048)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - x86 AMD An industry-wide issue was found in the way many modern microprocessor designs have implemented...

CVE-2018-6681

Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management NSM 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via appliance web interface...

CVE-2018-6681

Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management NSM 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via appliance web interface...

CVE-2018-6681 SB10244 - Network Security Management (NSM) - Abuse of Functionality vulnerability

Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management NSM 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via appliance web interface...

macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-004)

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid111136; scriptversion"1.10";...

Solaris 10 (sparc) : 148379-15

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Kernel. Supported versions that are affected are 10 and 11.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via DHCP to compromise Solaris. Successful attacks of this...

Solaris 10 (sparc) : 152100-81

JavaSE 8: update 181 patch equivalent to JDK 8u181, 64bit. Date this patch was last updated by Sun : Jul/16/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid111121;...

PT-2018-17710 · Mcafee · Mcafee Network Security Management

Name of the Vulnerable Software and Affected Versions: McAfee Network Security Management NSM versions 9.1.7.11 and earlier Description: The issue allows authenticated users to inject arbitrary HTML code into the response web page via the appliance web interface, potentially leading to abuse of...

Solaris 10 (sparc) : 152096-91

JavaSE 7: update 191 patch equivalent to. Date this patch was last updated by Sun : Jul/16/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid111119; scriptversion"1.6";...

macOS 10.13.x < 10.13.6 Multiple Vulnerabilities

The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6. It is, therefore, affected by multiple vulnerabilities. Note that successful exploitation of the most serious issues can result in arbitrary code execution. C Tenable Network Security, Inc...

NVIDIA Linux GPU Display Driver Multiple Vulnerabilities

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid111107; scriptversion"1.5";...

Debian DLA-1427-1 : znc security update

It was discovered that there were two issues in znc, a modular IRC bouncer : - There was insufficient validation of lines coming from the network allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf. CVE-2018-14055 - A path traversal vulnerability via '../'...