DLA-1268-1 p7zip - security update

Bulletin has no description...

JVN#15643848: Spring Security and Spring Framework vulnerable to authentication bypass

Spring Framework and Spring Security provided by Pivotal Software, Inc. contain an authentication bypass vulnerability. Impact A remote attacker can bypass authentication. As a result, the attacker gains access to the server and information may be disclosed. Solution Update the Software Update to...

Pyeongchang 2018: Staying Cyber Safe during the Olympics

As the 2018 Olympic Games in Pyeongchang approach, NCCIC/US-CERT reminds travelers to be aware of cybersecurity risks. At high-profile events, cyber activists may take advantage of the large audience to spread their message. Cyber criminals may attempt to steal personally identifiable information...

Cisco Aggregation Services Router 9000 Series IPv6 Fragment Header Denial of Service Vulnerability

A vulnerability in the IPv6 subsystem of Cisco IOS XR Software Release 5.3.4 for the Cisco Aggregation Services Router ASR 9000 Series could allow an unauthenticated, remote attacker to trigger a reload of one or more Trident-based line cards, resulting in a denial of service DoS condition. The...

Update Your Firefox Browser to Fix a Critical Remotely Exploitable Flaw

Mozilla has released an important update for its Firefox web browser to patch a critical vulnerability that could allow remote attackers to execute malicious code on computers running an affected version of the browser. The update comes just a week after the company rolled out its new Firefox...

Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability

Summary A vulnerability in the Secure Sockets Layer SSL VPN functionality of the Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double fr...

Security Advisory - Directory Traversal Vulnerability in Huawei eSpace Product

There is a directory traversal vulnerability in Huawei eSpace product. An authenticated, remote attacker can craft specific URL to the affected products. Due to insufficient verification of the URL, successful exploit will upload and download files and cause information leak and system crash...

Security Advisory - Buffer Overflow Vulnerability in the Bluetooth Module of Some Huawei Mobile Phones

There is a buffer overflow vulnerability in the Bluetooth module of some Huawei mobile phones. Due to insufficient input validation, an unauthenticated attacker may craft Bluetooth AVDTP/AVCTP messages after successful paring, causing buffer overflow. Successful exploit may cause code execution...

PT-2018-1004 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software versions prior to the fixed version Description: A vulnerability in the Secure Sockets Layer SSL VPN functionality could allow an unauthenticated, remote attacker to cause a reload of the affecte...

MGASA-2018-0102 Updated webkit2 packages fix security vulnerabilities

The webkit2 package has been updated to version 2.18.6, fixing several security issues and other bugs...

MGASA-2018-0099 Updated firefox packages fix security vulnerabilities

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096,...

CVE-2018-1000006

GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user click...

MGASA-2018-0093 Updated bind packages fix security vulnerability

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named CVE-2017-3145...

MGASA-2018-0091 Updated unbound packages fix security vulnerability

Updated unbound packages to fix security vulnerability CVE-2017-15105 in the processing of wildcard synthesized NSEC records. While synthesis of NSEC records is allowed by RFC4592, these synthesized owner names should not be used in the NSEC processing. This was, however, happenning in Unbound...

SUSE-SU-2018:0127-1 Security update for mercurial

This update for mercurial fixes the following issues: - CVE-2017-17458: In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of...

DSA-4089-1 bind9 - security update

Bulletin has no description...

MGASA-2018-0080 Updated nvidia-current packages mitigates security issues

This update provides version 384.111 from the R384 branch, in order to help mitigate Spectre and Meltdown CPU security issues and keeps the driver working with security hardened kernels. Note that so far, nVidia does believe that their GPUs are immune to the referenced security issues. It also ad...

MGASA-2018-0072 Updated flash-player-plugin package fixes security vulnerability

Adobe Flash Player 28.0.0.137 addresses an important out-of-bounds read vulnerability that could lead to information exposure CVE-2018-4871...

SUSE-SU-2018:0068-1 Security update for microcode_ctl

Update to Intel microcode version 20180108 bsc1075262 CVE-2017-5715 - The pre-released microcode fixing some important security issues is now officially published and included in the added tarball. Among other updates it contains: - IVT C0 06-3e-04:ed 428-42a - SKL-U/Y D0 06-4e-03:c0 ba-c2 -...

Microsoft Outlook CVE-2018-0793 Remote Code Execution Vulnerability

Description Microsoft Outlook is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of an affected system. Failed exploit attempts may result in a denial of service condition; this can result in the attacker gaining complete...