Sandbox Restrictions Bypass

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Ja...

Sandbox Restrictions Bypass

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java...

Information Disclosure

IBM Java SE is vulnerable to information disclosure. The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the...

Sandbox Restrictions Bypass

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java...

Sandbox Restrictions Bypass

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java...

freerdp: Integer overflow leading to heap-based buffer overflow in gdi_Bitmap_Decompress() function

A flaw was found in freerdp in versions before versions 2.0.0-rc4. An integer overflow that leads to a heap-based buffer overflow in the gdiBitmapDecompress function leads to memory corruption. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

TAU Threat Intelligence Notification: Operation SharpShooter

Operation Sharpshooter, leverages an embedded shellcode as an in-memory implant to download and retrieve a second-stage implant, which is known as Rising Sun. Rising Sun uses source code from the Duuzer backdoor that has been used in a past campaign of Lazarus group. This newly discovered campaig...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Personal Communications (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Personal Communications. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit...

SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2019:0539-1)

This update for freerdp to version 2.0.0rc4 fixes the following issues : Security issues fixed : CVE-2018-0886: Fix a remote code execution vulnerability CredSSP bsc1085416, bsc1087240, bsc1104918 CVE-2018-8789: Fix several denial of service vulnerabilities in the in the NTLM Authentication modul...

Chafer APT Takes Aim at Diplomats in Iran with Improved Custom Malware

UPDATE An Iran-linked APT known as Chafer has been spotted targeting various entities based in Iran with an enhanced version of a custom malware that takes a very unique approach to communication by using the Microsoft Background Intelligent Transfer Service BITS mechanism over HTTP. Meanwhile th...

Security Bulletin: Vulnerability in RC4 stream cipher affects MegaRAID Storage Manager (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects MegaRAID Storage Manager. MegaRAID Storage Manager has addressed the vulnerability. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects MegaRAID Storage Manager. MegaRAID Storage Manager has addressed the...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Systems Director Editions (CVE-2015-2808)

Summary The RC4 Bar Mitzvah Attack for SSL/TLS affects Tivoli Application Dependency Discovery Manager, IBM Tivoli Monitoring, and IBM Systems Director which are shipped as components of IBM System Director Editions. Information about the security vulnerabilityaffecting these components has been...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Flex System Chassis Management Module (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM Flex System Chassis Management Module. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM Flex System Chassis Management Module. Vulnerability Details: CVE-ID: CVE-2015-2808 Description: The RC4 algorithm...

Security Bulletin: Vulnerability in RC4 cipher stream and multiple vulnerabilities in IBM SDK Java Technology Edition affects IBM Systems Director

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition 7 that is used by IBM Systems Director. These issues were disclosed as part of the IBM Java SDK updates in January and April 2015. This bulletin also addresses the RC4 bar mitzvah attack on SSL/TLS. Vulnerability Detail...

Security Bulletin: Vulnerability in RC4 cipher stream (CVE-2015-2808) and multiple vulnerabilities in IBM SDK Java Technology Edition affects IBM Systems Director

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition 7 that is used by IBM Systems Director. These issues were disclosed as part of the IBM Java SDK updates in January and April 2015. This bulletin also addresses the RC4 bar mitzvah attack on SSL/TLS. Vulnerability Detail...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Systems Director Storage Control (CVE-2015-2808)

Summary The RC4 Bar Mitzvah Attack for SSL/TLS affects IBM Systems Director Storage Control. Vulnerability Details Summary The RC4 Bar Mitzvah Attack for SSL/TLS affects IBM Systems Director Storage Control. Vulnerability Details: CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in t...

Security Bulletin: Vulnerability in RC4 cipher stream (CVE-2015-2808) and multiple vulnerabilities in IBM SDK Java Technology Edition affects IBM Systems Director.

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition 7 that is used by IBM Systems Director. These issues were disclosed as part of the IBM Java SDK updates in January and April 2015. This bulletin also addresses the RC4 bar mitzvah attack on SSL/TLS. Vulnerability Detail...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Flex System Manager (FSM) (CVE-2015-2808)

Summary The RC4 Bar Mitzvah Attack for SSL/TLS affects IBM Flex System Manager FSM. Vulnerability Details Summary The RC4 Bar Mitzvah Attack for SSL/TLS affects IBM Flex System Manager FSM. Vulnerability Details: CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TLS protocol an...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM System Networking RackSwitch (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM System Networking RackSwitch. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM System Networking RackSwitch. Vulnerability Details CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TL...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru firmware. (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru firmware. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru firmware. Vulnerability Details CVE-ID:...