OPENSUSE-SU-2018:0614-1 Security update for tor

This update for tor to version 0.3.2.10 fixes security issues and bugs. The following vulnerabilities were fixed: - CVE-2018-0490: remote crash vulnerability against directory authorities boo1083845, TROVE-2018-001 - CVE-2018-0491: remote relay crash boo1083846, TROVE-2018-002 This new upstream...

USN-3587-1 dovecot vulnerabilities

It was discovered that Dovecot incorrectly handled parsing certain email addresses. A remote attacker could use this issue to cause Dovecot to crash, resulting in a denial of service, or possibly obtain sensitive information. CVE-2017-14461 It was discovered that Dovecot incorrectly handled TLS S...

CVE-2018-7286

CVE-2018-7286 affects Asterisk and Certified Asterisk prior to vendor patches: res_pjsip accepts a sequence of SIP INVITE messages over TCP/TLS from an authenticated remote user, then the connection is abruptly closed, causing a segmentation fault (DoS). Affected: Asterisk versions up to 13.19.1,...

CVE-2018-7286

An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. respjsip allows remote authenticated users to crash Asterisk segmentation fault by sending a number of SIP INVITE messages on a TCP or TLS connection and...

UBUNTU-CVE-2018-6543

In GNU Binutils 2.30, there's an integer overflow in the function loadspecificdebugsection in objdump.c, which results in malloc with 0 size. A crafted ELF file allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact...

Integer Overflow Vulnerability in Multiple Huawei Products

Huawei DP300, RP200, TE series, etc. are all-in-one desktop SmartZen and all-in-one video conferencing terminal products of Huawei China Company. An integer overflow vulnerability exists in multiple Huawei products, which is due to the device failing to adequately validate some fields in a messag...

Red Hat 389-ds-base stack buffer overflow vulnerability

Red Hat 389-ds-base is an American Red Hat package that includes a Linux directory server and a server administration command-line program. A stack buffer overflow vulnerability exists in Red Hat 389-ds-base versions 1.3.6.x prior to 1.3.6.13, 1.3.7.x prior to 1.3.7.9, and 1.4.x prior to 1.4.0.5....

Mozilla Firefox and Firefox ESR Memory Misreference Vulnerability (CNVD-2018-02645)

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A memory misreference vulnerability exists in Mozilla Firefox prior to version 58 and Firefox ESR...

Mozilla Firefox and Firefox ESR Memory Misreference Vulnerability (CNVD-2018-02640)

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A memory misreference vulnerability exists in Mozilla Firefox versions prior to 58 and Firefox ES...

OpenSSH sshd Denial of Service Vulnerability

OpenSSH OpenBSD Secure Shell is a set of connection tools for secure access to remote computers maintained by the OpenBSD Project Group. It is an open source implementation of the SSH protocol that supports encryption of all transmissions, effectively preventing eavesdropping, connection hijackin...

The vulnerability of the `csnmp_read_table` function in the SNMP plugin for the Collectd daemon allows a attacker to cause an application to terminate abnormally.

The vulnerability of the csnmpreadtable function snmp.c in the SNMP plugin for Collectd is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to cause the application to crash remotely or cause other adverse effects...

openSUSE Security Update : 389-ds (openSUSE-2017-1396)

This update for 389-ds fixes the following issues : - CVE-2017-7551: 389-ds-base: Password brute-force possible for locked account due to different return codes bsc1051997 - CVE-2016-4992: 389-ds: Information disclosure via repeated use of LDAP ADD operation bsc997256 - CVE-2016-5405: 389-ds:...

DEBIAN-CVE-2017-17740

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service slapd crash via a member MODDN operation...

PT-2017-4248 · Oracle +1 · Mysql Server

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 8.0.11 and prior Description: The issue is related to insufficient access control in the MySQL Server component, specifically in the Server: Security: Roles subcomponent. This allows an attacker with network access via...

FreeBSD : asterisk -- Remote Crash Vulnerability in RTCP Stack (4a67450a-e044-11e7-accc-001999f8d30b)

The Asterisk project reports : If a compound RTCP packet is received containing more than one report for example a Receiver Report and a Sender Report the RTCP stack will incorrectly store report information outside of allocated memory potentially causing a crash. %NASLMINLEVEL 70300 C Tenable...

CVE-2017-17664

A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack...

DEBIAN-CVE-2017-17664

A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack...

CVE-2017-17664

A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack...

Design/Logic Flaw

A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack...

CVE-2017-17664

A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack...