CentOS 7 : sssd (CESA-2017:3379)

An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

CentOS Update for libipa_hbac CESA-2017:3379 centos7

Check the version of libipahbac SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882813";...

Null pointer dereference

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to th...

CVE-2017-17439

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to th...

CVE-2017-17439

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to th...

CVE-2017-17439

CVE-2017-17439 affects Heimdal (libheimdal) up to version 7.4, where a vulnerability in the ASN.1/DER handling can be triggered by a crafted UDP packet with empty client name or realm data. The issue causes the KDC to dereference NULL pointers in kdc/kerberos5.c and der_length.c, leading to a seg...

CVE-2017-17439

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to th...

CVE-2017-17439

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to th...

libipa_hbac, libsss_autofs, libsss_certmap, libsss_idmap, libsss_nss_idmap, libsss_simpleifp, libsss_sudo, python, sssd security update

CentOS Errata and Security Advisory CESA-2017:3379 An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

PT-2017-14780

Name of the Vulnerable Software and Affected Versions Heimdal versions prior to 7.5 Description The issue allows remote unauthenticated attackers to crash the KDC by sending a crafted UDP packet with empty data fields for client name or realm. This leads to a segmentation fault due to the parser...

Scientific Linux Security Update : sssd on SL7.x x86_64 (20171205)

Security Fixes : - It was found that sssd's sysdbsearchuserbyupnres function did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use thi...

Code injection

The h264sliceinit function in libavcodec/h264slice.c in Libav 12.2 allows remote attackers to cause a denial of service segmentation fault and application crash via a crafted file...

CVE-2017-17128

The h264sliceinit function in libavcodec/h264slice.c in Libav 12.2 allows remote attackers to cause a denial of service segmentation fault and application crash via a crafted file...

CVE-2017-17129

The ffvc1mc4mvchroma4 function in libavcodec/vc1mc.c in Libav 12.2 allows remote attackers to cause a denial of service segmentation fault and application crash or possibly have unspecified other impact via a crafted file...

CVE-2017-17129

The ffvc1mc4mvchroma4 function in libavcodec/vc1mc.c in Libav 12.2 allows remote attackers to cause a denial of service segmentation fault and application crash or possibly have unspecified other impact via a crafted file...

CVE-2017-17128

The h264sliceinit function in libavcodec/h264slice.c in Libav 12.2 allows remote attackers to cause a denial of service segmentation fault and application crash via a crafted file...

CVE-2017-17129

Vulnerability in Libav 12.2: the ff_vc1_mc_4mv_chroma4 function in libavcodec/vc1_mc.c is exploitable via a crafted VC-1 file, enabling remote attackers to cause a denial of service (segmentation fault and application crash) or potentially other impacts. Affected component: Libav’s libavcodec/vc1...

PT-2017-14722

Name of the Vulnerable Software and Affected Versions Libav version 12.2 Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault and application crash, via a crafted file. This is due to a problem in the h264 slice init function. Recommendatio...

PT-2017-14723

Name of the Vulnerable Software and Affected Versions Libav version 12.2 Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault and application crash, or possibly have other unspecified impacts via a crafted file. This is due to a problem in...

CVE-2017-17128: Improper Restriction of Operations within the Bounds of a Memory Buffer

The h264sliceinit function in libavcodec/h264slice.c in Libav 12.2 allows remote attackers to cause a denial of service segmentation fault and application crash via a crafted file...