Design/Logic Flaw

Potential security vulnerabilities have been identified with HPE Nimble Storage systems in multi array group configurations. The vulnerabilities could be exploited by an attacker to gain elevated privileges on the array. The following NimbleOS versions, and all subsequent releases, contain a...

CVE-2019-11996

Potential security vulnerabilities have been identified with HPE Nimble Storage systems in multi array group configurations. The vulnerabilities could be exploited by an attacker to gain elevated privileges on the array. The following NimbleOS versions, and all subsequent releases, contain a...

CVE-2019-15683

TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e. This could possibly result into remote code execution, since stack frame is not protected with stack canary. This attack appear to be exploitable via network connectivity...

PSF-2019-7 CVE-2019-18348: CRLF injection via the host part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the host component of a URL follow...

SUSE-SU-2019:2480-1 Security update for gpg2

This update for gpg2 fixes the following issues: Security issue fixed: - CVE-2019-13050: Fixed denial-of-service attacks via big keys. bsc1141093 Non-security issue fixed: - Allow coredumps in X11 desktop sessions bsc1124847...

CVE-2019-5461

An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...

SUSE-SU-2019:2191-1 Security update for wavpack

This update for wavpack fixes the following issues: Security issues fixed: - CVE-2019-1010319: Fixed use of uninitialized variable in ParseWave64HeaderConfig that can result in unexpected control flow, crashes, and segfaults bsc1141334. - CVE-2019-11498: Fixed possible denial of service applicati...

SUSE-SU-2019:2104-1 Security update for wireshark

This update for wireshark to version 2.4.16 fixes the following issues: Security issue fixed: - CVE-2019-13619: ASN.1 BER and related dissectors crash bsc1141980...

SUSE-SU-2019:1896-1 Security update for libxml2

This update for libxml2 fixes the following issues: Issue fixed: - Fixed a bug related to the fix for CVE-2016-9318 which allowed xsltproc to access the internet even when --nonet was given and also was making docbook-xsl-stylesheets to have incomplete xml catalog file bsc1010675, bsc1126613 and...

SUSE-SU-2019:1351-2 Security update for gnutls

This update for gnutls fixes the following issues: Security issue fixed: - CVE-2018-16868: Fixed Bleichenbacher-like side channel leakage in PKCS1 v1.5 verification bsc1118087. Non-security issue fixed: - Explicitly require libnettle 3.4.1 to prevent missing symbol errors bsc1134856...

OPENSUSE-SU-2019:1658-1 Security update for libmediainfo

This update for libmediainfo fixes the following issues: CVE-2019-11373: Fixed out-of-bounds read in function FileAnalyze:GetL8 boo1133156 CVE-2019-11372: Fixed out-of-bounds read in function MediaInfoLib:FileTagsHelper:SynchedTest boo1133157 This update was imported from the...

SUSE-SU-2019:1480-1 Security update for sssd

This update for sssd fixes the following issues: Security issue fixed: - CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation bsc1124194 Non-security issues fixed: - Missing GPOs directory could have led to login problems bsc1132879 - Fix a crash by...

OPENSUSE-SU-2019:1400-1 Security update for pacemaker

This update for pacemaker fixes the following issues: Security issues fixed: - CVE-2019-3885: Fixed an information disclosure in log output. bsc1131357 - CVE-2018-16877: Fixed a local privilege escalation through insufficient IPC client-server authentication. bsc1131356 - CVE-2018-16878: Fixed a...

Input validation

A vulnerability in the local management CLI implementation for specific commands on the Cisco UCS B-Series Blade Servers could allow an authenticated, local attacker to overwrite an arbitrary file on disk. It is also possible the attacker could inject CLI command parameters that should not be...

CVE-2019-1725 Cisco UCS B-Series Blade Servers Local Management CLI Arbitrary File Creation or CLI Parameter Injection Vulnerability

A vulnerability in the local management CLI implementation for specific commands on the Cisco UCS B-Series Blade Servers could allow an authenticated, local attacker to overwrite an arbitrary file on disk. It is also possible the attacker could inject CLI command parameters that should not be...

MGASA-2019-0141 Updated dovecot packages fix security vulnerability

CVE-2019-7524: Missing input buffer size validation leads into arbitrary buffer overflow when reading fts or pop3 uidl header from Dovecot index. Exploiting this requires direct write access to the index files...

OPENSUSE-SU-2019:0296-1 Security update for apache2

This update for apache2 fixes the following issues: Security issues fixed: - CVE-2018-17189: Fixed a denial of service in modhttp2, via slow and unneeded request bodies bsc1122838 - CVE-2018-17199: Fixed that modsessioncookie did not respect expiry time bsc1122839 Non-security issue fixed: -...

SUSE-SU-2019:0627-1 Security update for nodejs10

This update for nodejs10 to versio 10.15.2 fixes the following issue: Security issue fixed: - CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active bsc1127532...

CVE-2018-4257

In macOS High Sierra before 10.13.5, a buffer overflow was addressed with improved size validation...

CVE-2018-1000858

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery CSRF vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window...