Security Bulletin: Vulnerabilities in bind affect PowerKVM (CVE-2016-2776, CVE-2016-8864)

Summary PowerKVM is affected by vulnerabilities in ISC Bind. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2016-2776 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an assertion failure in buffer.c while a nameserver is building responses to a...

CVE-2018-12504

tinyexr 0.9.5 has an assertion failure in ComputeChannelLayout in tinyexr.h...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation tinyexr 0.9.5 has an assertion failure in ComputeChannelLayout in tinyexr.h. Remediation There is no fixed version for tinyexr. References - Github.com - GitHub Issue...

CVE-2018-12504

tinyexr 0.9.5 has an assertion failure in ComputeChannelLayout in tinyexr.h...

CVE-2018-12504

tinyexr 0.9.5 has an assertion failure in ComputeChannelLayout in tinyexr.h...

CVE-2018-12504

CVE-2018-12504 affects tinyexr 0.9.5, with an assertion failure in ComputeChannelLayout in tinyexr.h. The issue is documented across multiple sources (NVD, Red Hat, CNVD, CNVD-like entries, OSV, etc.). The vulnerability centers on tinyexr 0.9.5 and its ComputeChannelLayout function; exploitation ...

CVE-2018-12504

tinyexr 0.9.5 has an assertion failure in ComputeChannelLayout in tinyexr.h...

MGASA-2018-0281 Updated jasper packages fix security vulnerabilities

Updated japser packages fix security vulnerabilities: An assertion failure was possible to trigger in JPCNOMINALGAIN CVE-2016-9396. Denial of service via a reachable assertion in the function jpcfirstone in libjasper/jpc/jpcmath.c could lead to denial of service CVE-2018-9055...

Updated jasper packages fix security vulnerabilities

Updated japser packages fix security vulnerabilities: An assertion failure was possible to trigger in JPCNOMINALGAIN CVE-2016-9396. Denial of service via a reachable assertion in the function jpcfirstone in libjasper/jpc/jpcmath.c could lead to denial of service CVE-2018-9055...

openSUSE Security Update : opencv (openSUSE-2018-534)

This update for opencv fixes the following issues : - CVE-2018-5268: Fixed a heap-based buffer overflow in incv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmtjpeg2000.cppwhen parsing a crafted image file. boo1075017 - CVE-2017-17760: Fixed an buffer overflow in function...

Security update for opencv (important)

This update for opencv fixes the following issues: - CVE-2018-5268: Fixed a heap-based buffer overflow in incv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmtjpeg2000.cppwhen parsing a crafted image file. boo1075017 - CVE-2017-17760: Fixed an buffer overflow in function...

GNU glibc < 2.27 - Local Buffer Overflow

GNU glibc Vendor Homepage: http://www.gnu.org/ CVE: CVE-2018-11237 POC: $ cat mempcpy.c define GNUSOURCE 1 include include define N 97699 char aN; char bN+128; int main void memset a, 'x', N; char c = mempcpy b, a, N; assert c == 0; $ gcc -g mempcpy.c -o mempcpy -fno-builtin-mempcpy $ ./mempcpy...

GNU C Library Buffer Overflow Vulnerability (CNVD-2018-10058)

The GNU C Library a.k.a. glibc, libc6 is an open-source, free C language compiler released under the LGPL license. A buffer overflow vulnerability exists in mempcpyavx512novzeroupper in GNU C Library version 2.27 and earlier. An attacker can exploit this vulnerability to cause an assertion failur...

ISC BIND Multiple Denial of Service Vulnerabilities (May 2018)

ISC BIND is prone to multiple denial of service vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:isc:bind";...

Denial Of Service (DoS)

libtiff.so is vulnerable to denial of service DoS attacks. The application does not properly assert that a value in the TIFFWriteDirectoryTagCheckedRational function of tifdirwrite.c is valid, leading to an assertion failure that can crash the application...

FreeBSD : BIND -- multiple vulnerabilities (94599fe0-5ca3-11e8-8be1-d05099c0ae8c)

ISC reports : An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. A problem with the implementation of the new serve-stale feature in BIND 9.12 can le...

BIND -- multiple vulnerabilities

ISC reports: An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. A problem with the implementation of the new serve-stale feature in BIND 9.12 can lea...

CVE-2018-10963

The TIFFWriteDirectorySec function in tifdirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service assertion failure and application crash via a crafted file, a different vulnerability than CVE-2017-13726...

Updated exempi package fixes security vulnerabilities

An issue was discovered in Exempi through 2.4.4. There is a stack-based buffer over-read in the PostScriptMetaHandler::ParsePSFile function in PostScriptHandler.cpp CVE-2018-7729. An issue was discovered in Exempi through 2.4.4. WEBPSupport.cpp does not check whether a bitstream has a NULL value,...

Updated libtiff packages fix security vulnerabilities

The TIFFWriteDirectorySec function in tifdirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service assertion failure and application crash via a crafted file, a different vulnerability than CVE-2017-13726. CVE-2018-10963 In LibTIFF 4.0.9, a heap-based buffer overflo...