[SECURITY] [DLA 1955-1] tcpdump security update

Package : tcpdump Version : 4.9.3-1deb8u1 CVE ID : CVE-2018-10103 CVE-2018-10105 CVE-2018-14461 CVE-2018-14462 CVE-2018-14463 CVE-2018-14464 CVE-2018-14465 CVE-2018-14466 CVE-2018-14467 CVE-2018-14468 CVE-2018-14469 CVE-2018-14470 CVE-2018-14879 CVE-2018-14880 CVE-2018-14881 CVE-2018-14882...

ALPINE-CVE-2018-16230

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgpattrprint MPREACHNLRI...

ALPINE-CVE-2018-14464

The LMP parser in tcpdump before 4.9.3 has a buffer over-read in print-lmp.c:lmpprintdatalinksubobjs...

CVE-2018-14467

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgpcapabilitiesprint BGPCAPCODEMP...

Important: Red Hat Security Advisory: skydive security update

An update for skydive is now available for Red Hat OpenStack Platform 14.0 Rocky. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

FreeBSD : bro -- invalid memory access or heap buffer over-read (55571619-454e-4769-b1e5-28354659e152)

Jon Siwek of Corelight reports : This is a security patch release to address a potential Denial of Service vulnerability : - The NTLM analyzer did not properly handle AV Pair sequences that were either empty or unterminated, resulting in invalid memory access or heap buffer over-read. The NTLM...

USN-4133-1: Wireshark vulnerabilities

It was discovered that Wireshark improperly handled certain input. A remote or local attacker could cause Wireshark to crash by injecting malformed packets onto the wire or convincing someone to read a malformed packet trace file...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect eDiscovery Analyzer

Summary eDiscovery Analyzer has addressed multiple vulnerabilities in IBM® SDK Java™ Technology Edition. These issues were disclosed as part of the IBM Java SDK updates in October 2018. Vulnerability Details CVEID: CVE-2018-3180 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related ...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM eDiscovery Analyzer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by IBM eDiscovery Analyzer. These issues were disclosed as part of the IBM Java SDK updates in Jul 2018. Vulnerability Details CVEID: CVE-2018-1517 DESCRIPTION: A flaw...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2017 - Includes Oracle Jan 2017 CPU affect IBM eDiscovery Analyzer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by IBM eDiscovery Analyzer. Vulnerability Details CVEID: CVE-2017-3289 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the...

bro -- invalid memory access or heap buffer over-read

Jon Siwek of Corelight reports: This is a security patch release to address a potential Denial of Service vulnerability: The NTLM analyzer did not properly handle AV Pair sequences that were either empty or unterminated, resulting in invalid memory access or heap buffer over-read. The NTLM analyz...

CVE-2018-19386

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI...

CVE-2018-19386

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI...

Cross site scripting

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI...

CVE-2018-19386

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected XSS in idcStateError where the page parameter is reflected into the HREF of the “Try Again” button at /iwc/idcStateError.iwc?page=. Exploitation would execute script in the victim’s browser, potentially enabling session hijack...

FreeBSD : bro -- NULL pointer dereference and Signed integer overflow (f56669f5-d799-4ff5-9174-64a6d571c451)

Jon Siwek of Corelight reports : This is a security patch release to address potential Denial of Service vulnerabilities : - NULL pointer dereference in the RPC analysis code. RPC analyzers e.g. MOUNT or NFS are not enabled in the default configuration. - Signed integer overflow in BinPAC-generat...

The vulnerability of the Trace File Analyzer (TFA) Collector utility, a clustering application for Oracle Clusterware, allows a malicious individual to gain unauthorized access to protected data or cause partial service failure.

The vulnerability of the Trace File Analyzer TFA Collector utility, a tool for clustering Oracle Clusterware, is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected data or cause partial service failure through...

Security Bulletin: A vulnerability in IBM Java SDK and IBM Java Runtime affect Rational Asset Analyzer.

Summary A vulnerability in IBM® SDK Java™ Technology Edition, Version 8.0.5.30 and IBM® Runtime Environment Java™ Version 8.0.5.30 used by Rational Asset Analyzer. Rational Asset Analyzer has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2602 DESCRIPTION: An unspecified...

CVE-2019-2860

Vulnerability in the Oracle Clusterware component of Oracle Support Tools subcomponent: Trace File Analyzer TFA Collector. The supported version that is affected is 12.1.0.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...

Oracle Support Tools Clusterware Component Denial of Service Vulnerability

Oracle Support Tools is a set of Oracle support tools from Oracle Corporation.Clusterware is a set of portable clusterware. A security vulnerability exists in the Trace File Analyzer TFA Collector subcomponent of the Clusterware component of Oracle Support Tools, version 12.1.0.2.0. An attacker...