CVE-2017-17497

CVE-2017-17497 affects Tidy 5.7.0. The vulnerability is in the prvTidyTidyMetaCharset function in clean.c, where the currentNode variable used in the “children of the head” processing path is modified inside a loop without validating the updated value. This can lead to a denial of service via a s...

CVE-2017-17497

In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service Segmentation Fault, because the currentNode variable in the "children of the head" processing feature is modified in the loop without validating the new value...

CentOS Update for libipa_hbac CESA-2017:3379 centos7

Check the version of libipahbac SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882813";...

CentOS 7 : sssd (CESA-2017:3379)

An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

CVE-2017-17439

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to th...

Null pointer dereference

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to th...

CVE-2017-17439

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to th...

CVE-2017-17439

CVE-2017-17439 affects Heimdal (libheimdal) up to version 7.4, where a vulnerability in the ASN.1/DER handling can be triggered by a crafted UDP packet with empty client name or realm data. The issue causes the KDC to dereference NULL pointers in kdc/kerberos5.c and der_length.c, leading to a seg...

CVE-2017-17439

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to th...

libipa_hbac, libsss_autofs, libsss_certmap, libsss_idmap, libsss_nss_idmap, libsss_simpleifp, libsss_sudo, python, sssd security update

CentOS Errata and Security Advisory CESA-2017:3379 An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Scientific Linux Security Update : sssd on SL7.x x86_64 (20171205)

Security Fixes : - It was found that sssd's sysdbsearchuserbyupnres function did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use thi...

CVE-2017-17129

The ffvc1mc4mvchroma4 function in libavcodec/vc1mc.c in Libav 12.2 allows remote attackers to cause a denial of service segmentation fault and application crash or possibly have unspecified other impact via a crafted file...

CVE-2017-17128

The h264sliceinit function in libavcodec/h264slice.c in Libav 12.2 allows remote attackers to cause a denial of service segmentation fault and application crash via a crafted file...

CVE-2017-17128

The h264sliceinit function in libavcodec/h264slice.c in Libav 12.2 allows remote attackers to cause a denial of service segmentation fault and application crash via a crafted file...

Code injection

The h264sliceinit function in libavcodec/h264slice.c in Libav 12.2 allows remote attackers to cause a denial of service segmentation fault and application crash via a crafted file...

CVE-2017-17129

The ffvc1mc4mvchroma4 function in libavcodec/vc1mc.c in Libav 12.2 allows remote attackers to cause a denial of service segmentation fault and application crash or possibly have unspecified other impact via a crafted file...

CVE-2017-17129

Vulnerability in Libav 12.2: the ff_vc1_mc_4mv_chroma4 function in libavcodec/vc1_mc.c is exploitable via a crafted VC-1 file, enabling remote attackers to cause a denial of service (segmentation fault and application crash) or potentially other impacts. Affected component: Libav’s libavcodec/vc1...

Updated memcached packages fix security vulnerability

The tryreadcommand function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service segmentation fault via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read CVE-2017-9951...

RHEL 7 : tcmu-runner (RHSA-2017:3277)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3277 advisory. The tcmu-runner packages provide a service that handles the complexity of the LIO kernel target's userspace passthrough interface TCMU. It...

Moderate: Red Hat Security Advisory: tcmu-runner security update

An update for tcmu-runner is now available for Red Hat Gluster Storage 3.3.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...