Debian DLA-928-1 : libsndfile security update

Multiple vulnerabilities were found in libsndfile, a popular library for reading/writing audio files. CVE-2017-7585 In libsndfile before 1.0.28, an error in the 'flacbuffercopy' function flac.c can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file. CVE-2017-758...

EulerOS 2.0 SP1 : mariadb (EulerOS-SA-2016-1011)

According to the versions of the mariadb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when...

EulerOS 2.0 SP1 : postgresql (EulerOS-SA-2016-1001)

According to the version of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An integer overflow flaw, leading to a heap-based buffer overflow, was found in the PostgreSQL handling code for regular expressions. A remote...

EulerOS 2.0 SP1 : bind (EulerOS-SA-2017-1025)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A denial of service flaw was found in the way BIND handled query responses when both DNS64 and RPZ were used. A remote attacker could use this fla...

EulerOS 2.0 SP1 : setroubleshoot, setroubleshoot-plugins (EulerOS-SA-2016-1033)

According to the versions of the setroubleshoot, setroubleshoot-plugins packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The setroubleshoot packages provide tools to help diagnose SELinux problems. When Access Vector Cache AVC messag...

CVE-2017-8289

CVE-2017-8289 describes a stack-based buffer overflow in RIOT OS, specifically in the ipv6_addr_from_str.c module (ipv6_addr_from_str function). The vulnerability affects RIOT builds prior to 2017-04-25 and can allow a local attacker, and potentially remote attackers, to cause a denial of service...

GE Multilin SR, UR, and URplus Protective Relays (Update A)

CVSS v3 8.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: GE Equipment: Multilin SR, UR, and URplus Protective Relays Vulnerabilities: Weak Cryptography for Passwords UPDATED INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-17-117-01 GE...

GE Multilin SR Protective Relays

CVSS v3 8.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: GE Equipment: Multilin SR Protective Relays Vulnerabilities: Weak Cryptography for Passwords AFFECTED PRODUCTS The following versions of Multilin SR protective relays are affected: 750 Feeder Protection Relay, firmwar...

Ubuntu 17.04 : qemu vulnerabilities (USN-3268-1)

Zhenhao Hong discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. CVE-2016-10028 It was discovered that QEMU incorrectly handled the JAZZ RC4030 device. A privileged attacker...

[SECURITY] Fedora 24 Update: nss-softokn-3.29.5-1.0.fc24

Network Security Services Softoken Cryptographic Module...

[SECURITY] Fedora 24 Update: nss-util-3.29.5-1.0.fc24

Utilities for Network Security Services and the Softoken module...

Sierra Wireless AirLink Raven XE and XT

CVSS v3 10.0 ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available. Vendor: Sierra Wireless Equipment: AirLink Raven XE and XT Vulnerabilities: Improper Authorization, Cross-Site Request Forgery, Insufficiently Protected Credentials REPOSTED INFORMATION This...

Debian DLA-913-1 : activemq security update

It was found that Apache ActiveMQ exposed a remote shutdown command in the ActiveMQConnection class. An attacker could use this flaw to achieve denial of service on a client. For Debian 7 'Wheezy', these problems have been fixed in version 5.6.0+dfsg-1+deb7u3. We recommend that you upgrade your...

CVE-2017-3544

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker wi...

CVE-2017-3623

CVE-2017-3623 is referenced in connected materials as EBBSHAVE/EBBISLAND RPC buffer overflow affecting IBM AIX on PPC. Public exploit entries (Exploit-DB) cite remote code execution via RPC, targeting IBM AIX PPC versions 6100-09-04-1441, 7100-03-05-1524, 7100-04-00-0000, 7200-01-01-1642. No offi...

CVE-2017-3455

CVE-2017-3455 affects Oracle MySQL Server (Server: Security: Privileges) with affected versions up to 5.7.17. An attacker with network access and low privileges could read or modify data via authenticated/privilege-enabled paths. The connected advisories confirm this is fixed in newer MySQL packa...

CVE-2017-3492

The CVE-2017-3492 vulnerability affects Oracle FLEXCUBE Enterprise Limits and Collateral Management (Infrastructure subcomponent) within Oracle Financial Services Applications. Affected versions are 12.0.0 and 12.1.0. The issue allows a low-privileged attacker with network access via HTTP to read...

CVE-2017-2331

CVE-2017-2331 affects Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1. The connected documents describe a firewall bypass vulnerability that could allow a network-based attacker to bypass firewall policies, leading to authentication bypass, information disc...

SUSE SLED12 / SLES12 Security Update : tigervnc (SUSE-SU-2017:1093-1)

This update for tigervnc provides the several fixes. These security issues were fixed : - CVE-2017-7392, CVE-2017-7396: Client can cause leak in VNC server bsc1031886 - CVE-2017-7395: Authenticated VNC client can crash VNC server bsc1031877 - CVE-2017-7394: Client can crash or block VNC server...

LogRhythm Network Monitor - Authentication Bypass / Command Injection

Exploit Title: LogRhythm Network Monitor Auth Bypass Root RCE Public Disclosure Date: 24 Apr 2017 Author: Francesco Oddo Reference: http://security-assessment.com/files/documents/advisory/Logrhythm-NetMonitor-Advisory.pdf Software Link: https://logrhythm.com/network-monitor-freemium/ Version:...