MGASA-2018-0446 Updated postgresql9.4|6 packages fix security vulnerabilities

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database CVE-2018-1058. Postgresql 9.6.x before 9.6.9 is vulnerable in the adminpac...

SUSE-SU-2018:2536-1 Security update for grafana, kafka, logstash and monasca-installer

This update for grafana, kafka, logstash and monasca-installer fixes the following issues: The following security issues have been fixed: grafana: - CVE-2018-12099: Fix Cross-Site-Scripting XSS vulnerabilities in dashboard links. bsc1096985 kafka: - CVE-2018-1288: Authenticated Kafka users may...

postgresql: Too-permissive access control list on function pg_logfile_rotate()

It was found that pgcatalog.pglogfilerotate, from the adminpack extension, did not follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it could use this flaw to force log rotation...

postgresql: Too-permissive access control list on function pg_logfile_rotate()

It was found that pgcatalog.pglogfilerotate, from the adminpack extension, did not follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it could use this flaw to force log rotation...

SUSE-SU-2018:2317-1 Security update for grafana, kafka, logstash, openstack-monasca-installer

This update for grafana, kafka, logstash, openstack-monasca-installer fixes the following issues: Security issues fixed: - CVE-2018-12099: grafana: Fix XSS vulnerabilities in dashboard links bsc1096985. - CVE-2018-3817: logstash: Fix inadvertently logging of sensitive information bsc1090849. Bug...

New Android P includes several security improvements

According to the Android developer Program Overview, the next major version of Android, Android 9.0 or P, is set to arrive soon. Their plans show a final release within the next three months Q3 2018. The end of the Android P beta program is approaching, with the first release candidate built and...

Best security practices for Trusted TLS Intermediary

According to Google over 75% of public websites are accessed over encrypted connections using HTTPS, with the use of HTTP diminishing. As expected, the bad actors are following the crowds, and using HTTPS to hide their activities. So how can security solutions such as ETP Threat Protector detect...

openSUSE Security Update : postgresql96 (openSUSE-2018-638)

PostgreSQL was updated to 9.6.9 fixing bugs and security issues : Release notes : - https://www.postgresql.org/about/news/1851/ - https://www.postgresql.org/docs/current/static/release-9-6-9.html A dump/restore is not required for those running 9.6.X. However, if you use the adminpack extension,...

Elastic Cloud Enterprise 1.1.4 security update

Elastic Cloud Enterprise use of shared encryption key ESA-2018-09 In Elastic Cloud Enterprise ECE versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable...

Design/Logic Flaw

Early or late retirement of rotation requests can result in a Use After Free condition in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-5847

Early or late retirement of rotation requests can result in a Use After Free condition in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

Fedora 27 : prosody (2018-455803056d)

Prosody 0.10.2 ============== See upstream's blog post at https://blog.prosody.im/prosody-0-10-2-security-release/ for a full overview of the release changes. Prosody 0.10.2 fixes a cross-host authentication vulnerability, CVE-2018-10847. The issue affects Prosody instances that have multiple...

PostgreSQL adminpack Extension Security Bypass Vulnerability

PostgreSQL is a free object-relational database management system developed by the PostgreSQL development group . The system supports most of the SQL standard and provides many other features such as foreign keys, triggers, views, etc. adminpack is one of the contrib modules. A security...

PostgreSQL logrotate Vulnerability (May 2018) - Windows

PostgreSQL is vulnerable in the adminpack extension, the pgcatalog.pglogfilerotate function doesn SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

Authentication flaw

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pgcatalog.pglogfilerotate function doesn't follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation...

UBUNTU-CVE-2018-1115

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pgcatalog.pglogfilerotate function doesn't follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation...

CVE-2018-1115

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pgcatalog.pglogfilerotate function doesn't follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation...

CVE-2018-1115

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pgcatalog.pglogfilerotate function doesn't follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation...

ALPINE-CVE-2018-1115

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pgcatalog.pglogfilerotate function doesn't follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation...

CVE-2018-1115

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pgcatalog.pglogfilerotate function doesn't follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation...