Security Bulletin: IBM Security Network Protection is affected by a vulnerability in coreutils (util-linux)

Summary A security vulnerability has been discovered in coreutils util-linux, which is used by IBM Security Network Protection. Vulnerability Details CVEID: CVE-2017-2616 DESCRIPTION: util-linux could allow a local authenticated attacker to bypass security restrictions, caused by a race condition...

Security Bulletin: IBM Security Access Manager for Mobile is affected by vulnerabilities in nss, nss-util, and nspr (CVE-2016-1978, CVE-2016-1979)

Summary Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. The nss-util packages provide utilities for use with the Network Security Services NSS libraries. Netscape Portable Runtime NSPR...

Security Bulletin: IBM Security Access Manager for Web is affected by vulnerabilities in nss, nss-util, and nspr (CVE-2016-1978, CVE-2016-1979)

Summary Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. The nss-util packages provide utilities for use with the Network Security Services NSS libraries. Netscape Portable Runtime NSPR...

Security Bulletin: Security Vulnerabilities in IBM HTTP Server (CVE-2017-9798, CVE-2017-12618)

Summary There is an information disclosure vulnerability and a denial of service vulnerability that affect the IBM HTTP Server used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-9798 DESCRIPTION: Apache HTTP Server could allow a remote attacker to obtain sensitive...

CVE-2018-9246

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

CVE-2018-9246

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

Code injection

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

CVE-2018-9246

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

CVE-2018-9246

The CVE-2018-9246 issue affects the PGObject::Util::DBAdmin Perl module prior to 0.120.0, used in LedgerSMB up to 1.5.x. It inadequately sanitizes/escapes variables used in shell commands, enabling shell code injection via create(), run_file(), backup(), or restore(). This allows an attacker to e...

CVE-2018-9246

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

CVE-2018-9246

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

CVE-2018-9246: Improper Encoding or Escaping of Output

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

Cross site scripting

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11650: Improper Neutralization of Input During Web Page Generation

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

Libmobi Information Disclosure Vulnerability (CNVD-2018-10876)

Libmobi is a C-based language for processing Kindle MOBI format e-book document library . A security vulnerability exists in the 'mobigetkf8boundaryseqnumber' function in the util.c file in Libmobi version 0.3. A remote attacker can exploit this vulnerability to disclose information heap-based...

Updated util-linux packages fix security vulnerability

A command injection flaw was found in the way util-linux implements umount autocompletion in Bash. An attacker with the ability to mount a filesystem with custom mount points may execute arbitrary commands on behalf of the user who triggers the umount autocompletion CVE-2018-7738...

MGASA-2018-0237 Updated util-linux packages fix security vulnerability

A command injection flaw was found in the way util-linux implements umount autocompletion in Bash. An attacker with the ability to mount a filesystem with custom mount points may execute arbitrary commands on behalf of the user who triggers the umount autocompletion CVE-2018-7738...

libvirt security and bug fix update

3.9.0-14.el75.4 - lxc: Drop useless check in live device update rhbz1557922 - Pass oldDev to virDomainDefCompatibleDevice on device update rhbz1557922 - qemu: Fix updating device with boot order rhbz1557922 - conf: Fix crash in virDomainDefCompatibleDevice rhbz1557922 - vmx: check for...

Critical Photon OS Security Update - PHSA-2018-0037

Updates of 'linux-aws', 'mysql', 'paramiko', 'linux-secure', 'patch', 'python3', 'net-snmp', 'linux-esx', 'binutils', 'linux', 'mercurial', 'pycrypto', 'python2', 'util-linux', 'xerces-c', 'zsh', 'sqlite' packages of Photon OS have been released...

CVE-2018-10186

In radare2 2.5.0, there is a heap-based buffer over-read in the rhexbin2str function libr/util/hex.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted DEX file. This issue is different from CVE-2017-15368...