PT-2018-6767

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.13 Description: The issue allows local users to cause a denial of service, resulting in a NULL pointer dereference and panic. This occurs when using a noflush merge option that triggers a NULL value for a flus...

CVE-2017-12134

The xenbiovecphysmergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability...

CVE-2017-12134: Incorrect Calculation

The xenbiovecphysmergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability...

[SECURITY] Fedora 26 Update: qpdf-6.0.0-8.fc26

QPDF is a command-line program that does structural, content-preserving transformations on PDF files. It could have been called something like pdf-to-pdf. It includes support for merging and splitting PDFs and to manipulate the list of pages in a PDF file. It is not a PDF viewer or a program...

Fedora 24 : libmtp (2017-d26266eb32)

libmtp 1.1.13 ============= Christophe Vu-Brugier 1 : - added GoPro HERO5 Black Emeric Grange 2 : - added GoPro HERO5 Session - rename F5321 into XPeria X Compact Gaute Hope 2 : - add GoPro Hero+ - add mtp-detect for GoPro Hero+ Jerry Zhang 1 : - Update Google device strings, add PTP+ADB id Marcu...

Mapbox: null pointer dereference and segfault in tile-count-merge

This crash was triggered with 642f773 while fuzzing tile-count-merge with AFL on Debian 8 x64. ./tile-count-merge -o /dev/null test000 ASAN:SIGSEGV ================================================================= ==10201==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 pc...

[SECURITY] Fedora 26 Update: java-1.8.0-openjdk-aarch32-1.8.0.131-1.170420.fc26

A preview release of the upstream OpenJDK AArch32 porting project. In due time it will be merged with the main java-1.8.0-openjdk package. This release may get security fixes late. Use carefully. The OpenJDK runtime environment...

GitLab Design Vulnerabilities

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing a project's file contents, commit history, bug lists, and more. There is a security...

CVE-2016-9469

Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could be exploited by an unauthenticated user. A fix...

CVE-2017-0882

Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC...

UBUNTU-CVE-2016-9469

Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could be exploited by an unauthenticated user. A fix...

CVE-2017-0882

Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC...

CVE-2017-0882

Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC...

CVE-2017-0882

Removed by vendor...

CVE-2017-0882: Authorization Bypass Through User-Controlled Key

Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC...

PT-2017-10683

Name of the Vulnerable Software and Affected Versions GitLab versions prior to 8.15.8 GitLab versions prior to 8.16.7 GitLab versions prior to 8.17.4 Description Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. Recommendations For...

GitLab: Unfiltered `class` attribute in markdown code

This affects merge request/issue comments and probably other parts of the user interface. I am demonstrating PoCs on GitLab.com itself, as they don't affect anything outside of my test repo, which is private. It could be used to execute some js actions by contructing content that uses the...

gitlab -- Various security issues

GitLab reports: Information Disclosure in Issue and Merge Request Trackers During an internal code review a critical vulnerability in the GitLab Issue and Merge Request trackers was discovered. This vulnerability could allow a user with access to assign ownership of an issue or merge request to...

MS17-014: Description of the security update for Word 2016: March 14, 2017

None None...

CVE-2016-9404

Cross-site scripting XSS vulnerability in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors related to login...