Security update for openssl-steam (important)

This update for openssl-steam fixes the following issues: - Merged changes from upstream openssl Factory rev 137 into this fork for Steam. Updated to openssl 1.0.2k: CVE-2016-7055: Montgomery multiplication may produce incorrect results boo1009528 CVE-2016-7056: ECSDA P-256 timing attack key...

Microsoft Edge: Chakra: AsmJSByteCodeGenerator::EmitCall call handling bug(CVE-2018-0780)

AsmJSByteCodeGenerator::EmitCall which is used to emit call insturctions doesn't check if an array identifier is used as callee. The method handles those invalid calls in the same way it handles valid calls such as "arridx & ...". In these cases, the index register remains NoRegister which is...

Microsoft Edge: Chakra: OOB read in AppendLeftOverItemsFromEndSegment(CVE-2018-0767)

Here's a snippet of AppendLeftOverItemsFromEndSegment in JavascriptArray.inl. growby = endSeg-length; current = current-GrowByMinrecycler, growby; CopyArraycurrent-elements + endIndex + 1, endSeg-length, Js::SparseArraySegmentendSeg-elements, endSeg-length;...

Microsoft Edge Chakra AsmJSByteCodeGenerator::EmitCall Call Handling

Microsoft Edge: Chakra: AsmJSByteCodeGenerator::EmitCall call handling bug CVE-2018-0780 AsmJSByteCodeGenerator::EmitCall which is used to emit call insturctions doesn't check if an array identifier is used as callee. The method handles those invalid calls in the same way it handles valid calls...

SUSE SLES12 Security Update : openssl (SUSE-SU-2018:0112-1)

This update for openssl fixes the following issues: Security issues fixed : - CVE-2016-7056: ECSDA P-256 timing attack key recovery bsc1019334 - CVE-2017-3731: Truncated packet could crash via OOB read bsc1022085 - CVE-2016-8610: remote denial of service in SSL alert handling bsc1005878 -...

Microsoft Edge Chakra JIT asm.js Out-Of-Bounds Read

Microsoft Edge: Chakra: OOB read in asm.js CVE-2017-11911 Here's a snippet of AsmJSByteCodeGenerator::EmitAsmJsFunctionBody. AsmJsVar initSource = nullptr; if decl-sxVar.pnodeInit-nop == knopName AsmJsSymbol initSym = mCompiler-LookupIdentifierdecl-sxVar.pnodeInit-name, mFunction; if...

Microsoft Edge Chakra - asm.js Out-of-Bounds Read

Microsoft Edge Chakra - asm.js Out-of-Bounds Read / Here's a snippet of AsmJSByteCodeGenerator::EmitAsmJsFunctionBody. AsmJsVar initSource = nullptr; if decl-sxVar.pnodeInit-nop == knopName AsmJsSymbol initSym = mCompiler-LookupIdentifierdecl-sxVar.pnodeInit-name, mFunction; if...

openSUSE Security Update : openssl (openSUSE-2017-1324)

This update for openssl fixes the following issues : Security issues fixed : - CVE-2017-3735: openssl1,openssl: Malformed X.509 IPAdressFamily could cause OOB read bsc1056058 - CVE-2017-3736: openssl: bnsqrx8xinternal carry bug on x8664 bsc1066242 - Out of bounds read+crash in DESfcrypt bsc106536...

Apple macOS - Kernel Code Execution due to Lack of Bounds Checking in AppleIntelCapriController::GetLinkConfig

Apple macOS - Kernel Code Execution due to Lack of Bounds Checking in AppleIntelCapriController::GetLinkConfig / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1375 AppleIntelCapriController::GetLinkConfig trusts a user-supplied value in the structure input which it uses to ind...

CVE-2017-16362

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability is an instance of an out of bounds read vulnerability in the MakeAccesible plugi...

CVE-2017-16362

Technical details about CVE-2017-16362 are not provided in the supplied documents. Public information appears limited to vulnerability description and CVSS metrics; monitor for updates from official advisories for affected products, impact, and fixes.

FreeBSD : OpenSSL -- Multiple vulnerabilities (f40f07aa-c00f-11e7-ac58-b499baebfeaf)

The OpenSSL project reports : bnsqrx8xinternal carry bug on x8664 CVE-2017-3736 Severity: Moderate There is a carry propagating bug in the x8664 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be ver...

OpenSSL Multiple Vulnerabilities (Nov 2017) - Linux

OpenSSL is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl"; ifdescription...

Fedora 26 : xen (2017-5bcddc1984)

xen: various flaws 1501391 multiple MSI mapping issues on x86 XSA-237 DMOP map/unmap missing argument checks XSA-238 hypervisor stack leak in x86 I/O intercept code XSA-239 Unlimited recursion in linear pagetable de-typing XSA-240 Stale TLB entry due to page type release race XSA-241 page type...

Broadcom ICMPv6 Information Leak Vulnerability

Exploit for hardware platform in category dos / poc Broadcom: Information Leak in ICMPv6 Router Advertisement Offloading CVE-2017-11122 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers,...

Apple PCIe Message Ring Protocol Race Conditions Vulnerability

Exploit for macOS platform in category dos / poc Apple: Multiple Race Conditions in PCIe Message Ring protocol leading to OOB Write and OOB Read CVE-2017-7115 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile...

OpenSSL 'OOB read' Security Bypass Vulnerability - Windows

OpenSSL is prone to an SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl"; ifdescription...

OpenSSL 'OOB read' Security Bypass Vulnerability - Linux

OpenSSL is prone to an SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl"; ifdescription...

Vulnerability in OpenSSL - Malformed X.509 IPAddressFamily could cause OOB read

While parsing an IPAdressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. Found by Google OSS-Fuzz...

Qemu: display: cirrus: OOB read access issue

An out-of-bounds access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions for example, cirrusbitbltropfwdtransp. A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in...