SUSE-SU-2018:0384-1 Security update for mariadb

This update for mariadb to version 10.0.33 fixes several issues. These security issues were fixed: - CVE-2017-10378: Vulnerability in subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL...

GNU Binutils load_specific_debug_section() function denial of service vulnerability

GNU Binutils a.k.a. GNU Binary Utilities or binutils is a set of programming language utility programs developed by the GNU Project to work with target files in a variety of formats, with connectors, assemblers, and other tools for target files and archives. A security vulnerability exists in the...

January 31, 2018—KB4058258 (OS Build 16299.214)

None None...

USN-3541-2 linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities

USN-3541-1 addressed vulnerabilities in the Linux kernel for Ubuntu 17.10. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS. Jann Horn discovered that microprocessors utilizing speculative execution and branch...

Unspecified Vulnerability in Oracle Support Tools OSS Support Tools Component (CNVD-2018-01720)

Oracle Support Tools is the United States Oracle Oracle company's set of Oracle support tools. OSS Support Tools is one of the object storage support tools. A security vulnerability exists in the Diagnostic Assistant subcomponent of the OSS Support Tools component of Oracle Support Tools prior to...

UBUNTU-CVE-2018-2689

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBo...

Oracle VM VirtualBox Elevation of Privilege Vulnerability (CNVD-2018-02062)

Oracle Virtualization is the American Oracle Oracle company's set of hardware and software virtualization management solutions. Oracle VM VirtualBox is one of the virtual machine components. A security vulnerability exists in the Oracle VM VirtualBox component of Oracle Virtualization, versions...

Oracle VM VirtualBox Elevation of Privilege Vulnerability (CNVD-2018-02061)

Oracle Virtualization is the American Oracle Oracle company's set of hardware and software virtualization management solutions. Oracle VM VirtualBox is one of the virtual machine components. A security vulnerability exists in the Oracle VM VirtualBox component of Oracle Virtualization, versions...

January 18, 2018—KB4073291 (OS Build 16299.201)

None None...

The vulnerability of the libffi library arises from a buffer out-of-bounds operation, allowing an attacker to execute arbitrary code.

The vulnerability of the libffi library arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a local attacker to execute arbitrary code by forcing the installation of a runtime stack on the i386 architecture...

UBUNTU-CVE-2017-17852

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops...

Micro Focus Project and Portfolio Management Center Cross-Site Request Forgery Vulnerability

Micro Focus Project and Portfolio Management Center is a suite of project portfolio management software from Micro Focus UK. The software manages hybrid projects by integrating agile tools such as ALM Octane, Agile Manager and CA Rally. A cross-site request forgery vulnerability exists in Micro...

CVE-2017-14361

Man-In-The-Middle vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability could be exploited to allow a Man-in-the-middle attack...

CVE-2017-16684

SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentication checks for functionalities that require user identity...

CVE-2017-8816

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service integer overflow and resultant buffer overflow, and application crash or possibly have unspecified other impact via vectors involving long user and password fields...

mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2017)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromis...

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based...

UBUNTU-CVE-2017-16830

The printgnupropertynote function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, which allows remote attackers to cause a denial of service segmentation violation and application crash or possibly have unspecified other impact via a crafted ELF...

radare2 denial of service vulnerability (CNVD-2017-36084)

radare2 is a set of libraries and tools for working with binary files. A security vulnerability exists in the 'storeversioninfognuverneed' function in the libr/bin/format/elf/elf.c file in radare2 version 2.0.1. A remote attacker can exploit this vulnerability to cause a denial of service...

UBUNTU-CVE-2017-15932

In radare2 2.0.1, an integer exception negative number leading to an invalid memory access exists in storeversioninfognuverdef in libr/bin/format/elf/elf.c via crafted ELF files when parsing the ELF version on 32bit systems...