Security Advisory - Dirty COW Vulnerability in Huawei Products

In the morning of October 21th, 2016, a security researcher Phil Oester disclosed a local privilege escalation vulnerability in Linux kernel. A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write COW breakage of private read-only memory mappings. An...

SUSE-SU-2016:3001-1 Security update for libX11

libX11 was updated to fix a memory leak that was introduced with the security fix for CVE-2016-7942...

ManageEngine Password Manager Pro fails to restrict access permissions

Overview ManageEngine Password Manager Pro provided by Zoho Corporation fails to restrict access permissions. Impact A user may gain unauthorized access to other users' password entry history. Solution Update the Software This vulnerability has been addressed in Password Manager Pro 8.4.0 Build...

SaAT Netizen fails to properly verify downloaded installation and update files

Overview SaAT Netizen contains a vulnerability where files downloaded for installation or an update are not properly verified. The SaAT Netizen installer and SaAT Netizen contain a vulnerability where downloaded files are not properly verified during the installation or update process...

Downloads Resources over HTTP

Overview Affected versions of fuseki insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on th...

Downloads Resources over HTTP

Overview Affected versions of prince insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on th...

Downloads Resources over HTTP

Overview Affected versions of alto-saxophone insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code executi...

kintone mobile for Android fails to verify SSL server certificates

Overview kintone mobile for Android provided by Cybozu, Inc. fails to verify SSL server certificates in WebView. Note that this vulnerability is different from JVN91816422. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc...

MGASA-2016-0400 Updated bzip2 packages fix security vulnerability

A use-after-free flaw was found in bzip2recover, leading to a null pointer dereference, or a write to a closed file descriptor. An attacker could use this flaw by sending a specially crafted bzip2 file to recover and force the program to crash CVE-2016-3189...

Kunena,K4.0.0 - K5.0.3,XSS (Cross Site Scripting)

Kunena,K4.0.0 - K5.0.3,XSS Cross Site Scripting Resolution: update to 5.0.4 update notice:https://www.kunena.org/blog/179-kunena-5-0-4-released...

Security Advisory - Buffer Overflow Vulnerability in Huawei Firewall Products

The security policy processing module of some Huawei firewall products have a buffer overflow vulnerability. An authenticated attacker may setup a specific security policy into the devices, causing buffer overflow and crash the system. Vulnerability ID: HWPSIRT-2016-06074 This vulnerability has...

SUSE-SU-2016:2894-1 Security update for GraphicsMagick

This update for GraphicsMagick fixes the following issues: - Memory allocation failure in AcquireMagickMemory CVE-2016-8862 bsc1007245...

Security Advisory - Buffer Overflow Vulnerability in HIFI Driver of Huawei Smart Phone

The HIFI driver of some Huawei products has buffer overflow vulnerability due to the lack of a parameters check. An attacker can get ROOT privilege and send given parameter to driver to crash the system or execute arbitrary code. Vulnerability ID: HWPSIRT-2016-05220 This vulnerability has been...

Security Advisory - Buffer Overflow Vulnerability in TP Driver of Huawei Smart Phone

Touch Panel TP driver of some Huawei products have one buffer overflow vulnerability due to the lack of a parameters check. An attacker can get ROOT privilege and to send given parameter to TP driver to crash the system or execute arbitrary code. Vulnerability ID: HWPSIRT-2016-05224 This...

MGASA-2016-0391 Updated wireshark packages fix security vulnerability

The wireshark package has been updated to version 2.0.8, which fixes several security issues where a malformed packet trace could cause it to crash or go into an infinite loop, and fixes several other bugs as well. See the release notes for details...

Cisco Unified Communications Manager Web Interface Cross-Site Scripting Vulnerability

A vulnerability in several parameters of the ccmivr page of Cisco Unified Communication Manager CallManager could allow an unauthenticated, remote attacker to launch a cross-site scripting XSS attack against a user of the web interface on the affected system. The vulnerability is due to...

Security Advisory - DoS Vulnerability in Some Huawei Firewall Products

Some Huawei firewall products have a denial of service DoS vulnerability. Due to improper validation of some specific fields of DHCP message, an unauthenticated attacker may send abnormal DHCP request packets to the affected products. Successful exploit of this vulnerability could lead to a DoS...

JVN#75396659: DERAEMON-CMS vulnerable to cross-site scripting

DERAEMON-CMS provided by TEAM DERAEMONS is a content management system CMS. install.php in DERAEMON-CMS contains a cross-site scripting vulnerability CWE-79 due to a flaw in processing of the parameters hostname, database and username. Impact An arbitrary script may be executed on the user's web...

MGASA-2016-0373 Updated freeimage packages fix security vulnerability

Multiple vulnerabilities were discovered in the FreeImage multimedia library, which might result in denial of service or the execution of arbitrary code if a malformed XMP or RAW image is processed. CVE-2015-3885, CVE-2016-5684...

Microsoft Internet Explorer and Edge CVE-2016-7198 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue to execute arbitrary code in the context of the currentl...