kernel security and bug fix update

2.6.32-696.20.1.OL6 - Update genkey bug 25599697 2.6.32-696.20.1 - x86 kaiser/efi: unbreak tboot Waiman Long 1519799 1519802 CVE-2017-5754 - x86 pti/mm: Fix trampoline stack problem with XEN PV Waiman Long 1519799 1519802 CVE-2017-5754 - x86 pti/mm: Fix XEN PV boot failure Waiman Long 1519799...

Cross-site Scripting (XSS)

sentry-provider-db is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as HTTP TRACE requests are possible, which can lead to XSS attacks...

IBM MQ service trace module elevation of privilege vulnerability

IBM MQ formerly known as IBM WebSphere MQ is a messaging middleware product from IBM. It provides a reliable and proven messaging backbone for Service Oriented Architecture SOA. service trace module is one of the service trace modules. An elevation of privilege vulnerability exists in the service...

CVE-2017-1612

IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: 132953...

Code injection

IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: 132953...

CVE-2017-1612

IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: 132953...

PT-2019-8526 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.14.11 Description: An issue was discovered in the Linux kernel. A double free may be caused by the function allocate trace buffer in the file kernel/trace/trace.c. Recommendations: For Linux kernel versions...

Stack overflow

The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a writemmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h...

Synaptics Says Claims of a Keylogger in HP Laptops are False

Synaptics said reports that claim hundreds of HP laptops contain a secret keylogger made by the company are inaccurate. In a statement released Wednesday, the company said its software was being mischaracterized as a keylogger. It also said it would remove the debugging component from production...

MGASA-2017-0445 Updated wireshark packages fix security vulnerability

The wireshark package has been updated to version 2.2.11, which fixes a few security issues where a malformed packet trace could cause it to crash, and fixes several other bugs as well. See the release notes for details...

Updated wireshark packages fix security vulnerability

The wireshark package has been updated to version 2.2.11, which fixes a few security issues where a malformed packet trace could cause it to crash, and fixes several other bugs as well. See the release notes for details...

Wireshark 'epan/dissectors/packet-cipsafety.c' Denial of Service Vulnerability

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A denial of service vulnerability exists in Wireshark...

IBM Rational Collaborative Lifecycle Management Information Disclosure Vulnerability

IBM Rational Collaborative Lifecycle Management CLM is a suite of collaborative lifecycle management solutions from IBM in the United States. The solution combines three products, RTC, RQM, and RRC, in a single IBM SmartCloud Enterprise cloud environment image to provide requirements management,...

CVE-2017-1241

An unspecified vulnerability in IBM Jazz Foundation based applications might allow the display of stack trace information to an attacker. IBM X-Force ID: 124523...

Design/Logic Flaw

An unspecified vulnerability in IBM Jazz Foundation based applications might allow the display of stack trace information to an attacker. IBM X-Force ID: 124523...

CVE-2017-1241

CVE-2017-1241 is a vulnerability described in IBM/CLM Jazz Foundation based applications, where an unspecified issue could cause stack trace information to be exposed to an attacker. The related IBM Security Bulletin lists multiple Jazz-based products affected (e.g., Rational CLM, RDNG, RELM, RTC...

CVE-2017-1241

An unspecified vulnerability in IBM Jazz Foundation based applications might allow the display of stack trace information to an attacker. IBM X-Force ID: 124523...

HPE Universal CMDB 'HTTP TRACE' Information Disclosure Vulnerability

The host is installed with HP Universal CMDB and is prone to an information disclosure vulnerability. OpenVAS Vulnerability Test $Id: gbhpeuniversalcmdbhttptraceinfodiscvuln.nasl 7497 2017-10-19 07:06:06Z santu $ HPE Universal CMDB 'HTTP TRACE' Information Disclosure Vulnerability Authors: Rinu...

SSL Handshake Failure on ADC Because of Unsupported Ciphers

SSL connection failsbetween the client and the ADCappliance ADC responds with a fatal alert. The description of the alert message is “Handshake Failure 40”. The above screenshot is from a NetScaler trace packet capture. Procedure to run a trace on the ADC is explained in the following document:...

CVE-2017-1378

IBM Spectrum Protect 7.1 and 8.1 formerly Tivoli Storage Manager disclosed unencrypted login credentials to Vmware vCenter in the application trace output which could be obtained by a local user. IBM X-Force ID: 126875...