JDK: Failure to privatize a value pulled out of the loop by versioning

All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the...

JDK: Failure to privatize a value pulled out of the loop by versioning

All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the...

PT-2019-20093

Name of the Vulnerable Software and Affected Versions GraphicsMagick affected versions not specified Description The issue concerns indirect reads that could disclose file contents from the local system. Recommendations At the moment, there is no information about a newer version that contains a...

RHEL 7 : opensc (RHSA-2019:2154)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2154 advisory. The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic...

The vulnerability of the AdaptiveThresholdImage function in the console-based image editing tool ImageMagick allows a hacker to cause a service failure or expose protected information.

The vulnerability of the AdaptiveThresholdImage function MagickCore/threshold.c in the console-based image editing tool ImageMagick involves reading data beyond the buffer boundaries in dynamic memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or reveal...

kernel: out-of-bound read in memcpy_fromiovecend()

A flaw was found in the Linux kernel that allows the userspace to call memcpyfromiovecend and similar functions with a zero offset and buffer length. This can cause a read beyond the buffer boundaries flaw and, in certain cases, cause a memory access fault and a system halt by accessing invalid...

opensc: Out of bounds reads handling responses from smartcards

Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs...

UBUNTU-CVE-2019-14283

In the Linux kernel before 5.2.3, setgeometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy...

CVE-2019-2727

Vulnerability in the Oracle Application Testing Suite component of Oracle Enterprise Manager Products Suite subcomponent: Load Testing for Web Apps. The supported version that is affected is 13.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

GHSA-CMFG-87VQ-G5G4 Deserialization of untrusted data in FasterXML jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled either globally or for a specific property for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specificall...

Deserialization of untrusted data in FasterXML jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled either globally or for a specific property for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specificall...

moinejf abcm2ps buffer overflow vulnerability

moinejf abcm2ps is a command line program that converts music tunes from ABC notation to PostScript or SVG format. The 'getkey' function in the parse.c file and the 'delayedoutput' function in the music.c file in moinejf abcm2ps 8.13.16 and earlier versions have a Buffer Overflow Vulnerability. T...

The vulnerability of the __usb_get_extra_descriptor function in the USB subsystem of Linux kernel systems allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the usbgetextradescriptor function in the USB subsystem’s driver code drivers/usb/core/usb.c in Linux kernels is related to errors in reading the additional descriptor. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of th...

openSUSE Security Update : libssh2_org (openSUSE-2019-1640)

This update for libssh2org fixes the following issues : - Fix the previous fix for CVE-2019-3860 bsc1136570, bsc1128481 Out-of-bounds reads with specially crafted SFTP packets This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

EulerOS 2.0 SP8 : freerdp (EulerOS-SA-2019-1646)

According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfxdecompresssegment that results in a memory corruption...

Security update for libssh2_org (moderate)

openSUSE Security Update: Security update for libssh2org Announcement ID: openSUSE-SU-2019:1640-1 Rating: moderate References: 1128481 1136570 Cross-References: CVE-2019-3860 Affected Products: openSUSE Leap 42.3 An update that solves one vulnerability and has one errata is now available...

PT-2019-20091

Name of the Vulnerable Software and Affected Versions GraphicsMagick affected versions not specified Description The issue concerns indirect reads that could disclose file contents from the local system. Recommendations At the moment, there is no information about a newer version that contains a...

Security update for GraphicsMagick (moderate)

openSUSE Security Update: Security update for GraphicsMagick Announcement ID: openSUSE-SU-2019:1623-1 Rating: moderate References: 1138425 Affected Products: openSUSE Backports SLE-15 An update that contains security fixes can now be installed. Description: This update for GraphicsMagick fixes th...

OPENSUSE-SU-2019:1619-1 Security update for GraphicsMagick

This update for GraphicsMagick fixes the following issues: - disable indirect reads that disclosed file contents from the local system boo1138425...

PT-2019-20090

Name of the Vulnerable Software and Affected Versions GraphicsMagick affected versions not specified Description The issue in GraphicsMagick allows indirect reads to disclose file contents from the local system. Recommendations At the moment, there is no information about a newer version that...