MGASA-2018-0144 Updated golang packages fix security vulnerability

Updated golang packages fix security vulnerabilities: Go before 1.9.4 allows "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked CVE-2018-6574...

MGASA-2018-0135 Updated glpi packages fix security vulnerability

The glpi package has been updated to version 9.1.6, which fixes several security issues and other bugs. See the upstream release announcements for details. An issue in the php-zetacomponents-base package which prevented GLPI from working has also been fixed...

MGASA-2018-0141 Updated advancecomp packages fix security vulnerability

Joonun Jang discovered a vulnerability in AdvanceCOMP that could be used to crash or run programs if it opened a specially crafted ZIP file...

MGASA-2018-0133 Updated quagga packages fix security vulnerability

This is an update to fix several security issues. 1. CVE-2018-5379: Fix double free of unknown attribute 2. CVE-2018-5380: debug print of received NOTIFY data can over-read msg array 3. CVE-2018-5381: fix infinite loop on certain invalid OPEN messages...

MGASA-2018-0130 Updated mpv packages fix security vulnerability

Josef Gajdusek reported that mpv 0.27.0 was vulnerable to an attack through it's youtube-dl hook. This could cause remote code execution. This upstream update creates of list of sure protocols to use through the hook...

Code injection

In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any cryptographic protection of the downloaded contents. An attacker with a privileged network position which could be...

CVE-2018-7298

Affected product: eQ-3 AG HomeMatic CCU2 (version 2.29.22). Issue: loopupd.sh downloads software update packages over HTTP, which provides no cryptographic protection. Root cause: lack of integrity/ authenticity verification for firmware updates due to plain HTTP delivery. Impact: attacker with n...

DSA-4121-1 gcc-6 - update

Bulletin has no description...

Jimtawl, 2.2.6, Arbitrary File Upload

Jimtawl from janguo.de, 2.2.6, arbitrary file upload Resolution: update to 2.2.7 Update notice: http://janguo.de/lang-de/joomla-25-higher/jimtawl.html...

JVN#75453852: LINE for iOS fails to verify SSL server certificates

LINE for iOS provided by LINE Corporation fails to verify SSL server certificates due to the vulnerability existed in the Third Party SDK which is incorporated in the application. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. According to the...

MGASA-2018-0128 Updated freetype2 packages fix security vulnerability

Updated freetype2 packages fix security vulnerability: FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the ttsizereset function in truetype/ttobjs.c CVE-2017-7864...

DLA-1277-1 audacity - security update

Bulletin has no description...

DSA-4105-2 mpv - regression update

Bulletin has no description...

MP Form Mail CGI eCommerce Edition vulnerable to OS command injection

Overview MP Form Mail CGI eCommerce Edition provided by futomi Co., Ltd. is a CGI used to send mail from a web form. MP Form Mail CGI eCommerce Edition contains an OS command injection vulnerability CWE-78. Daiki Ichinose of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA...

PT-2018-8640 · Cisco · Cisco Content Security Management Appliance +1

Name of the Vulnerable Software and Affected Versions: Cisco Email Security Appliance affected versions not specified Cisco Content Security Management Appliance affected versions not specified Description: A issue in the spam quarantine could allow an authenticated, remote attacker to download a...

Cisco UCS Central Arbitrary Command Execution Vulnerability

A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the daemon user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by posting...

Cisco Virtualized Packet Core-Distributed Instance Denial of Service Vulnerability

A vulnerability in the ingress packet processing functionality of the Cisco Virtualized Packet Core-Distributed Instance VPC-DI Software could allow an unauthenticated, remote attacker to cause both control function CF instances on an affected system to reload, resulting in a denial of service Do...

Security Advisory - Two Out-of-Bounds Read Vulnerabilities in Some Huawei Products

Some Huawei products have two out-of-bounds read vulnerabilities due to the improper processing of malformed H323 messages. A remote attacker that controls a server could exploit this vulnerability by sending malformed H323 reply messages to a target device. Successful exploit could make the devi...

OPENSUSE-SU-2018:0359-1 Security update for chromium

This update for chromium to version 64.0.3282.140 fixes the following security issues: - CVE-2018-6406: Various asan fixes boo1078463, boo1079021 The regular expression library re2 was updated to 2018-02-01...

Spring Security and Spring Framework vulnerable to authentication bypass

Overview Spring Framework and Spring Security provided by Pivotal Software, Inc. contain an authentication bypass vulnerability. Macchinetta Framework Development Team : NTT COMWARE, NTT DATA Corporation, and NTT reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...