Security Bulletin: NVIDIA GeForce Experience (GFE) Security Updates for CPU Speculative Side Channel Vulnerabilities

NVIDIA GeForce Experience GFE response to CPU speculative side channel vulnerabilities - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 Bulletin Summary NVIDIA is providing an initial security update to mitigate aspects of Google Project Zero's January 3, 2018 publication of novel information...

MGASA-2018-0059 Updated backintime packages fix security vulnerability

backintime aka Back in Time before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft...

SUSE-SU-2018:0007-1 Security update for qemu

This update for qemu fixes the following issues: A new feature was added: - Support EPYC vCPU type bsc1052825 fate324038 Also a mitigation for a security problem has been applied: - CVE-2017-5715: QEMU was updated to allow passing through new MSR and CPUID flags from the host VM to the CPU, to...

Intel In Security Hot Seat Over Reported CPU Design Flaw

UPDATE Intel is grappling with what many experts are describing as a processor design flaw impacting CPUs used in Linux, Windows and some macOS systems. The reported flaw is tied to Intel’s kernel virtual memory system that could allow an attacker to access kernel-protected data such as passwords...

MGASA-2018-0014 Updated gstreamer0.10-plugins-ugly/gstreamer1.0-plugins-ugly packages fix security vulnerability

Hanno Boeck discovered multiple vulnerabilities in the GStreamer media framework and its codecs and demuxers, which may result in denial of service or the execution of arbitrary code if a malformed media file is opened CVE-2017-5846, CVE-2017-5847...

MGASA-2018-0010 Updated ipsec-tools packages fix security vulnerability

It was discovered that racoon, the ipsec-tools IKE daemon, incorrectly handled certain ISAKMP fragments. A remote attacker could use this issue to cause racoon to crash, resulting in a denial of service CVE-2016-10396...

MGASA-2017-0481 Updated openjpeg2 packages fix security vulnerability

A heap-based buffer overflow was discovered in the opjt2encodepacket function. The vulnerability caused an out-of-bounds write, which may have lead to remote denial of service or possibly unspecified other impact CVE-2017-14039. An invalid write access was discovered in bin/jp2/convert.c,...

MGASA-2017-0484 Updated icu packages fix security vulnerability

Integer overflow in ICU in the Persian calendar CVE-2017-15422...

MGASA-2017-0474 Updated jasper packages fix security vulnerabilities

The jasper package has been updated and patched to fix several security issues...

My Projects,2.0,SQL Injection

My Projects,2.0,SQL Injection Resolution: update to version 2.1 Update notice: http://www.gegabyte.org/downloads/joomla-extensions/joomla3/components/292-my-projects...

Security Advisory - Activation Lock Bypass Vulnerability on Smartphones

There is an activation lock bypass vulnerability on Smartphones. The smartphone is supposed to be activated by the former account after reset if find my phone function is on. The software does not have a sufficient protection of activation lock. Successful exploit could allow an attacker to bypas...

Security Advisory - Weak Cryptography Vulnerability in Some Huawei Products

Some Huawei products have a weak cryptography vulnerability. Due to not properly some values in the certificates, an unauthenticated remote attacker could forges a specific RSA certificate and exploits the vulnerability to pass identity authentication and logs into the target device to obtain...

Microsoft Azure Government Cloud support

Challenge Direct Restore to Azure functionality does not support Microsoft Azure Government Cloud. Cause Microsoft Azure Government Cloud requires a different Azure environment configuration that Veeam Backup & Replication 9.5 Update 3 does not implement out of the box. Solution Please perform...

PT-2017-3585 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.14.13 Description: The issue is related to errors in resource management within the Parallel Crypto Engine crypto/pcrypt.c subsystem of the Linux operating system. It can be exploited by executing a specially...

Security Advisory - Arbitrary Lock Pattern Change Vulnerability in Huawei HiWallet APP

Huawei HiWallet App has an arbitrary lock pattern change vulnerability. It needs to verify the user's Huawei ID during lock pattern change. An attacker with root privilege who gets a user's smart phone may bypass Huawei ID verification by special operation. Successful exploit of this vulnerabilit...

Security Advisory - Integer Overflow Vulnerability on Smartphones

There is an integer overflow vulnerability on smartphones. The software does not process certain variable properly when handle certain process. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could cause information disclosure. Vulnerability...

SUSE-SU-2017:3369-1 Security update for java-1_6_0-ibm

This update for java-160-ibm fixes the following issues: Security issues fixed: - Security update to version 6.0.16.50 bsc1070162 CVE-2017-10346 CVE-2017-10285 CVE-2017-10388 CVE-2017-10356 CVE-2017-10293 CVE-2016-9841 CVE-2017-10355 CVE-2017-10357 CVE-2017-10348 CVE-2017-10349 CVE-2017-10347...

Multiple vulnerabilities in H2O

Overview H2O is an open source web server software. H2O contains multiple vulnerabilities listed below. A Denial-of-service DoS due to a flaw in processing HTTP/1 header CWE-20 - CVE-2017-10868 Stack-based buffer overflow CWE-121 - CVE-2017-10869 A Denial-of-service DoS due to a flaw in outputtin...

DSA-4066-1 otrs2 - security update

Bulletin has no description...

MGASA-2017-0450 Updated evince packages fix security vulnerability

It was discovered that Evince incorrectly handled printing certain DVI files. If a user were tricked into opening and printing a specially-named DVI file, an attacker could use this issue to execute arbitrary code CVE-2017-1000159...