About the security content of Xcode 14.3

About the security content of Xcode 14.3 This document describes the security content of Xcode 14.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided

A flaw was found in samba. The Netlogon RPC implementations may use the rc4-hmac encryption algorithm, which is considered weak and should be avoided even if the client supports more modern encryption types. This issue could allow an attacker who knows the plain text content communicated between...

K01993501: Linux kernel vulnerability CVE-2016-10906

Security Advisory Description An issue was discovered in drivers/net/ethernet/arc/emacmain.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arcemactx and arcemactxclean. CVE-2016-10906 Impact There is no impact; F5 products are not affected by...

SUSE CVE-2005-2945

arc 5.21j and earlier create temporary files with world-readable permissions, which allows local users to read sensitive information from files created by 1 arc arc.c or 2 marc marc.c...

SUSE CVE-2005-2992

arc 5.21j and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different type of vulnerability than CVE-2005-2945...

SUSE CVE-2010-3372

Untrusted search path vulnerability in NorduGrid Advanced Resource Connector ARC before 0.8.3 allows local users to gain privileges via vectors related to the LDLIBRARYPATH environment variable. NOTE: some of these details are obtained from third party information...

SUSE CVE-2016-10906

An issue was discovered in drivers/net/ethernet/arc/emacmain.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arcemactx and arcemactxclean...

SUSE CVE-2018-25008

In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::getmut method. This synchronization issue can be lead to memory safety issues through race conditions...

SUSE CVE-2019-6461

An issue was discovered in cairo 1.16.0. There is an assertion problem in the function cairoarcindirection in the file cairo-arc.c...

SUSE CVE-2019-6462

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function arcerrornormalized in the file cairo-arc.c, related to arcmaxanglefortolerancenormalized...

SUSE CVE-2020-35711

An issue has been discovered in the arc-swap crate before 0.4.8 and 1.x before 1.1.0 for Rust. Use of arcswap::access::Map with the Constant test helper or with a user-supplied implementation of the Access trait could sometimes lead to dangling references being returned by the map...

CISA Releases Six Industrial Control Systems Advisories

CISA released six Industrial Control Systems ICS advisories on February 9, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for...

CLSA-2023-1675372486 Fix CVE(s): CVE-2022-3437

SECURITY UPDATE: heap-based buffer overflows in Heimdal ARC4 and DES3 - debian/patches/CVE-2022-3437.patch: add extra NULL pointer and buffer boundaries checks, fix undefined behaviour and input data length calculations, remove accidentally duplicated code in arcfour.c - CVE-2022-3437...

CISA Releases Six Industrial Control Systems Advisories

CISA released six Industrial Control Systems ICS advisories on December 20, 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for...

ARC Informatique PcVue

1. EXECUTIVE SUMMARY CVSS v3 5.5 ATTENTION: Low attack complexity Vendor: ARC Informatique Equipment: PcVue Vulnerabilities: Cleartext Storage of Sensitive Information, Insertion of Sensitive Information into Log File 2. UPDATE OR REPOSTED INFORMATION This updated advisory is a follow-up to the...

The vulnerability of the Azure Guest Configuration component of the Azure Policy creation, assignment, and definition management service, along with the Azure Arc management platform, is related to deficiencies in access control. This allows attackers to escalate their privileges.

The vulnerability of the Azure Guest Configuration component of the Azure Policy service, which is responsible for creating, assigning, and managing policy definitions, is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to increase their privileges...

GSD-2022-1006652 ARC: mm: fix leakage of memory allocated for PTE

ARC: mm: fix leakage of memory allocated for PTE This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.7 by commit...

ts-arc-kyoto.com Cross Site Scripting vulnerability OBB-3030481

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Microsoft Patch Tuesday October 2022: Exchange ProxyNotShell RCE, Windows COM+ EoP, AD EoP, Azure Arc Kubernetes EoP

Hello everyone! This episode will be about Microsoft Patch Tuesday for October 2022, including vulnerabilities that were added between September and October Patch Tuesdays. As usual, I use my open source Vulristics project to create the report. Alternative video link for Russia: $ cat...

The vulnerability of the Azure Arc for local infrastructure connection software in Azure Stack Edge storage services allows a perpetrator to escalate their privileges.

The vulnerability of the Azure Arc for local infrastructure connection software in Azure Stack Edge storage solutions is related to access control errors. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...