Debian: Security Advisory (DSA-4238-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Your Mac Does Not Turn On: How to fix

If you are using your Mac every day with no issues, then that’s great. However, sometimes, like all computers, the Mac also does not respond to pressing the power button. If this happens, and you have no idea what to do, then it can lead to a lot of frustration. There could be several reasons why...

Busybox Code Execution Vulnerability

BusyBox is a set of applications containing several linux commands and tools maintained by Ukrainian software developer Denis Vlasenko. A security vulnerability exists in the 'busybox wget' mini-application in Busybox, which stems from the program's failure to validate SSL certificates. An attack...

EulerOS 2.0 SP3 : shadow-utils (EulerOS-SA-2018-1169)

According to the version of the shadow-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A buffer overflow flaw leading to heap memory corruption was found in the shadow-utils's newusers utility. A local, authenticated attacker cou...

patch: Malicious patch files cause ed to execute arbitrary commands

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's...

Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Installation Manager and IBM Packaging Utility (CVE-2015-7575)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 that is used by IBM Installation Manager and IBM Packaging Utility. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016...

file: Denial of service

Background file is a utility that guesses a file format by scanning binary data for patterns. Description File does not properly utilize the docorenote function in readelf.c in libmagic.a. Impact A remote attacker could send a specially crafted ELF file possibly resulting in a Denial of Service...

DEBIAN-CVE-2018-12327

Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which nt...

When It Comes To IoT Security, Liability Is Muddled

BOSTON—From hacked connected cars to power grids, the implications of IoT security issues seem to be getting graver – yet when it comes to pointing fingers for security troubles, many times victims don’t even know where to start. IoT experts said at the Security of Things Forum today said that a...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Installation Manager and IBM Packaging Utility

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by IBM Installation Manager and IBM Packaging Utility. These issues were disclosed as part of the IBM Java SDK updates in January 2018. Vulnerability Details CVEID: CVE-2018-2579 DESCRIPTION: An unspecifie...

Security Bulletin: Rational Directory Administrator is affected by an Apache Tomcat vulnerability (CVE-2016-3092)

Summary Rational Directory Administrator, which is installed with Rational Directory Server Tivoli 5.2.1 iFix 9 and earlier, is affected by an Apache Tomcat security vulnerability CVE-2016-3092. Install a new interim fix of Rational Directory Server to resolve this issue. Vulnerability Details...

Security Bulletin: Vulnerabilities in unzip affect IBM DataPower Gateways (CVE-2014-8141)

Summary IBM DataPower Gateways has addressed a vulnerability in 'unzip utility' that it uses to list, test, or extract files from a zip archive. Vulnerability Details CVEID: CVE-2014-8141 DESCRIPTION: Info-ZIP UnZip is vulnerable to a buffer overflow, caused by improper bounds checking by the...

F5 BIG-IP Information Disclosure Vulnerability (CNVD-2018-15635)

F5 BIG-IP as an access solution provides SSL VPN remote access, security, application acceleration and high availability for remote users. An information disclosure vulnerability exists in F5 BIG-IP due to a flaw in the F5 BIG-IP configuration utility, which can be exploited by an attacker to vie...

CVE-2018-5525

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive...

CVE-2018-5525

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive...

Command injection

On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility, restrictions on...

CVE-2018-5525

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive...

CVE-2018-5525

The CVE-2018-5525 issue affects F5 BIG-IP Configuration utility. A local-file vulnerability may allow authenticated users to retrieve files local to the BIG-IP system that contain only F5-provided data (not configuration data or customer data). Affected versions include BIG-IP 13.0.0, 12.1.0–12.1...

CVE-2018-5525: Exposure of Sensitive Information to an Unauthorized Actor

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive...

PT-2018-17019

Name of the Vulnerable Software and Affected Versions F5 BIG-IP Configuration utility versions 11.2.1, 11.5.1 through 11.5.5, 11.6.1 through 11.6.3.1, 12.1.0 through 12.1.2, 13.0.0 Description A local file issue exists in the F5 BIG-IP Configuration utility that exposes files containing F5-provid...