December 12, 2017—KB4054519 (Monthly Rollup)

None None...

December 12, 2017—KB4054523 (Security-only update)

None None...

December 12, 2017—KB4053581 (OS Build 10240.17709)

None None...

December 12, 2017—KB4053579 (OS Build 14393.1944)

None None...

December 12, 2017—KB4053578 (OS Build 10586.1295)

None None...

December 12, 2017—KB4054521 (Security-only update)

None None...

December 12, 2017—KB4053580 (OS Build 15063.786)

None None...

December 12, 2017—KB4054520 (Monthly Rollup)

None None...

December 12, 2017—KB4054518 (Monthly Rollup)

None None...

December 12, 2017—KB4054517 (OS Build 16299.125)

None None...

macOS / iOS - Kernel Double Free due to Incorrect API Usage in Flow Divert Socket Option Handling

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1373 SOFLOWDIVERTTOKEN is a socket option on the SOLSOCKET layer. It's implemented by flowdiverttokensetstruct socket so, struct sockopt sopt in flowdivert.c. The relevant code is...

App Layering: Machine Time on a Published Image is Wrong at First Boot

When booting a published machine for instance, the template VM for MCS the first time, the local time for Windows is wrong by hours. The timezone is correct, but the initial time is set incorrectly for that time zone. This can break Windows and Office activation, and potentially cause other...

OpenJDK: unbounded memory allocation in SimpleTimeZone deserialization (Serialization, 8181323)

Vulnerability in the Java SE, JRockit component of Oracle Java SE subcomponent: Serialization. Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

[ASA-201711-30] powerdns: access restriction bypass

Arch Linux Security Advisory ASA-201711-30 ========================================== Severity: Low Date : 2017-11-27 CVE-ID : CVE-2017-15091 Package : powerdns Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-519 Summary ======= The package powerdns before...

Razer US: Authenticated DOM-based XSS in deals.razerzone.com via the rurl parameter.

The researcher discovered that deals.razerzone.com was vulnerable to Authenticated DOM-based XSS via the rurl parameter, which could allow account hijacking via session cookies. The researcher identified the specific code snippet and provided two PoCs with different techniques. Another great repo...

CVE-2017-3166

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any...

CVE-2017-3166: Incorrect Permission Assignment for Critical Resource

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any...

USN-3346-3: Bind vulnerabilities

USN-3346-1 and USN-3346-2 fixed two vulnerabilities in Bind and a regression, respectively. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Clément Berthaux discovered that Bind did not correctly check TSIG authentication for zone update requests. An...

Vastal I-Tech Agent Zone SQL Injection Vulnerability

Vastal I-Tech Agent Zone aka The Real Estate Script is a real estate website management system. A SQL injection vulnerability exists in Vastal I-Tech Agent Zone aka The Real Estate Script. A remote attacker can exploit this vulnerability to inject SQL commands...

Vastal I-Tech Dating Zone SQL Injection Vulnerability

Vastal I-Tech Dating Zone is a dating site system. The system supports user registration, search and forums. A SQL injection vulnerability exists in Vastal I-Tech Dating Zone version 0.9.9. A remote attacker can exploit the vulnerability by sending the 'productid' parameter to the addtocart.php...