[SECURITY] Fedora 37 Update: redis-7.0.5-1.fc37

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

Security Bulletin: IBM Intelligent Operations Center 1.5 WebSphere Application Server - Oracle Java CPU April 2013

Abstract The Java vulnerabilities identified in the April 2013 Oracle Java security alert need to be fixed in IBM Intelligent Operations Center 1.5. The procedures in this security bulletin identify appropriate IBM patches for these Java vulnerabilities and directs how to apply them. No reference...

Security Bulletin: IBM Intelligent Operations Center vulnerability in incoming event data fields (CVE-2012-6360)

Abstract Incoming event data fields could contain malicious JavaScript code that would execute in the Intelligent Operations Center user’s web browser Content CVE ID: CVE-2012-6360 DESCRIPTION: IBM Intelligent Operations Center receives event data from various external sources, and displays the...

CVE-2022-36025

Besu (Java-based Ethereum client) contains a numeric conversion bug in gas calculation for CALL/DELEGATECALL, affecting versions after 22.1.3 and before 22.7.1. The error in 32-bit signed/unsigned arithmetic can pass incorrect gas to called contracts and return gas, potentially causing a differin...

CVE-2022-36025 Incorrect Conversion between Numeric Types in Besu Ethereum Client

Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in...

GHSA-4456-W38R-M53X Besu VM vulnerable to gas allocation error in CALL operations

Impact An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in th...

Besu VM vulnerable to gas allocation error in CALL operations

Impact An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in th...

Researchers Uncover New Metador APT Targeting Telcos, ISPs, and Universities

A previously undocumented threat actor of unknown origin has been linked to attacks targeting telecom, internet service providers, and universities across multiple countries in the Middle East and Africa. "The operators are highly aware of operations security, managing carefully segmented...

PT-2022-23124 · Besu · Besu

Name of the Vulnerable Software and Affected Versions: Besu versions 22.1.4 through 22.7.0 Description: The issue is related to an incorrect conversion between numeric types in the calculation of available gas in CALL operations, including DELEGATECALL. This results in incorrect gas being passed...

Adobe InDesign Buffer Overflow Vulnerability (CNVD-2022-66017)

Adobe InDesign, a set of typesetting and editing applications from Adobe, has a buffer overflow vulnerability that originates from out-of-bounds reads and could lead to a memory leak. An attacker could use the vulnerability to execute unauthorized commands and could gain system privileges to...

Security Bulletin: Operations Dashboard is vulnerable to request smuggling due to Golang Go vulnerability CVE-2022-1705

Summary Operations Dashboard is vulnerable to request smuggling due to Golang Go vulnerability CVE-2022-1705 Vulnerability Details CVEID:CVE-2022-1705 DESCRIPTION: Golang Go is vulnerable to HTTP request smuggling, caused by a flaw with accepting of some invalid Transfer-Encoding headers in the...

CVE-2022-23950

In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations...

CVE-2022-23950

In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations...

CVE-2022-23950

In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations...

CVE-2022-23950

In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations...

U.S. Adds 2 More Chinese Telecom Firms to National Security Threat List

The U.S. Federal Communications Commission FCC has added Pacific Network Corp, along with its subsidiary ComNet USA LLC, and China Unicom Americas Operations Limited, to the list of communications equipment and services that have been deemed a threat to national security. The agency said the...

CVE-2022-35090

SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via asanmemcpy at /asan/asaninterceptorsmemintrinsics.cpp:...

Security Bulletin: Operations Dashboard is vulnerable to multiple Golang Go vulnerabilities

Summary Operations Dashboard is vulnerable to Go vulnerabilities listed below. Vulnerability Details CVEID:CVE-2022-32189 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in Float.GobDecode and Rat GobDecode in math/big. By sending a specially-crafted message, a remot...

Unknown Iranian attackers leverage vulnerabilities to conduct ransom operations

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Iranian government-sponsored actors carry out malicious cyber activities against a wide range of people and entities in the United States, Australia, Canada, and the United Kingdom by using known...

Security Bulletin: Multiple vulnerabilities in log4j-1.2.16.jar used by IBM Operations Analytics - Log Analysis

Summary The following security issues have been identified in the log4j-1.2.16.jar included as part of the IBM Operations Analytics - Log Analysis product. Vulnerability Details CVEID:CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system,...