[SECURITY] Fedora 29 Update: systemd-239-8.gite339eae.fc29

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

CVE-2019-6133: Concurrent Execution using Shared Resource with Improper Synchronization

In PolicyKit aka polkit 0.115, the "start time" protection mechanism can be bypassed because fork is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c...

CVE-2017-9704

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, There is no synchronization between msmvb2 buffer operations which can lead to use after free...

Design/Logic Flaw

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, There is no synchronization between msmvb2 buffer operations which can lead to use after free...

CVE-2017-9704

CVE-2017-9704 concerns CAF Android kernels (Android for MSM, Firefox OS for MSM, QRD Android) where there is no synchronization between msm_vb2 buffer operations, enabling a use-after-free condition. Root cause: missing synchronization in buffer handling within the kernel component msm_vb2. Affec...

CVE-2017-9704

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, There is no synchronization between msmvb2 buffer operations which can lead to use after free...

CVE-2018-17244: Concurrent Execution using Shared Resource with Improper Synchronization

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; wh...

PT-2018-3560

Name of the Vulnerable Software and Affected Versions: WildFly versions up to 16.0.0.Final Description: A flaw in WildFly allows local users who can execute init.d scripts to terminate arbitrary processes on the system. This can be exploited by modifying the PID file in /var/run/jboss-eap/,...

Crowd silently ignores changes to active status of users in Azure AD.

When Crowd synchronises users for the very first time from Azure AD it will recognise "active" state of users correctly. Unfortunately, on next synchronisations Crowd ignores changes to these statuses, so once they are set, they will never change...

Step 1. Identify users: top 10 actions to secure your environment

This series outlines the most fundamental steps you can take with your investment in Microsoft 365 security solutions. Well provide advice on activities such as setting up identity management through active directory, malware protection, and more. In this post, we explain how to create a single...

Salesforce Suite - Moderately critical - Access bypass - SA-CONTRIB-2018-078

This module enables Drupal to synchronize entities with Salesforce records. The module includes a page that does not sufficiently protect access rights, resulting in potential information disclosure. This vulnerability is mitigated by the fact that only Drupal entity title and IDs, and Salesforce...

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 Vaadin 10.0.0 through 10.0.7, and Vaadin 11.0.0 through 11.0.2 allows attacker to update element property values via crafted synchronization message. See CWE-754: Improper Check for Unusual or Exceptional...

PT-2018-3377

Name of the Vulnerable Software and Affected Versions: QEMU affected versions not specified Description: The issue is related to the use of a shared resource with incorrect synchronization during file renaming in the QEMU hardware emulator, specifically in the v9fs wstat function. This can be...

Yi Home Camera Firmware Downgrade Vulnerability

Yi Home Camera is an IoT home camera sold worldwide. A firmware downgrade vulnerability exists in the time synchronization feature of the Yi Home Camera 27US 1.8.7.0D. An attacker can cause a buffer overflow by intercepting and altering network traffic and exploiting the vulnerability via special...

[SECURITY] Fedora 28 Update: systemd-238-10.git438ac26.fc28

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

Intel (Skylake Kaby Lake) - PortSmash CPU SMT Side-Channel

Intel Skylake Kaby Lake - PortSmash CPU SMT Side-Channel Summary This is a proof-of-concept exploit of the PortSmash microarchitecture attack, tracked by CVE-2018-5407. Setup Prerequisites A CPU featuring SMT e.g. Hyper-Threading is the only requirement. This exploit code should work out of the b...

Yi Technology Home Camera 27US TimeSync Code Execution Vulnerability

Summary An exploitable firmware downgrade vulnerability exists in the time syncing functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted packet can cause a buffer overflow, resulting in code execution. An attacker can intercept and alter network traffic to trigger this vulnerability...

SUSE-SU-2018:3467-1 Security update for smt

SMT was updated to version 3.0.38. Following security issue was fixed: - CVE-2018-12472: Harden hostname check during sibling check by forcing double reverse lookup bsc1104076 Following non security issues were fixed: - Add migration path check when registration sharing is enabled - Fix sibling...

Voice of the Customer: Walmart embraces the cloud with Azure Active Directory

Todays post was written by Sue Bohn, partner director of Program Management and Ben Byford and Gerald Corson, senior directors of Identity and Access Management at Walmart. Greetings! Im Sue Bohn, partner director of Program Management at Microsoft. Im an insatiable, lifelong learner and I lead t...

CVE-2018-0473

A vulnerability in the Precision Time Protocol PTP subsystem of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition of the Precision Time Protocol. The vulnerability is due to insufficient processing of PTP packets. An attacker could explo...