openSUSE Security Update : ucode-intel (openSUSE-2019-1084)

This update for ucode-intel fixes the following issues : Updated to the 20190312 bundle release bsc1129231 New Platforms : - AML-Y22 H0 6-8e-9/10 0000009e Core Gen8 Mobile - WHL-U W0 6-8e-b/d0 000000a4 Core Gen8 Mobile - WHL-U V0 6-8e-d/94 000000b2 Core Gen8 Mobile - CFL-S P0 6-9e-c/22 000000a2...

SUSE SLED12 / SLES12 Security Update : ucode-intel (SUSE-SU-2019:0736-1)

This update for ucode-intel fixes the following issues : Updated to the 20190312 bundle release bsc1129231 New Platforms : AML-Y22 H0 6-8e-9/10 0000009e Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000a4 Core Gen8 Mobile WHL-U V0 6-8e-d/94 000000b2 Core Gen8 Mobile CFL-S P0 6-9e-c/22 000000a2 Core Gen9...

SUSE SLED15 / SLES15 Security Update : ucode-intel (SUSE-SU-2019:0712-1)

This update for ucode-intel fixes the following issues : Updated to the 20190312 bundle release bsc1129231 New Platforms : AML-Y22 H0 6-8e-9/10 0000009e Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000a4 Core Gen8 Mobile WHL-U V0 6-8e-d/94 000000b2 Core Gen8 Mobile CFL-S P0 6-9e-c/22 000000a2 Core Gen9...

Mail.ru: XXE on pulse.mail.ru

XML External Entity injection XXE in RSS/Atom feed parsing code in pulse.mail.ru allowed access to local files. All Mail.Ru projects are covered by extended scope bug bounty program...

Downloads Resources over HTTP in atom-node-module-installer

Affected versions of atom-node-module-installer insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code...

GHSA-87G3-X896-W798 Downloads Resources over HTTP in atom-node-module-installer

Affected versions of atom-node-module-installer insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code...

Bento4 Assertion Failure Vulnerability

Bento4 is a C++ class library and tool for reading and writing ISO-MP4 files. An Assertion Failure vulnerability exists in AP4AtomListWriter::Action in Core/Ap4Atom.cpp in Bento4 1.5.1-627, which can be exploited by an attacker to cause a denial of service program crash...

UBUNTU-CVE-2019-7697

An issue was discovered in Bento4 v1.5.1-627. There is an assertion failure in AP4AtomListWriter::Action in Core/Ap4Atom.cpp, leading to a denial of service program crash, as demonstrated by mp42hls...

Pointer dereference in subsystem in Intel(R) Graphics Driver allows unprivileged user to elevate privileges via local access

Summary: The Intel® Graphics Drivers for Windows Code can fail to adequately validate a pointer input. This may lead to modification of kernel memory and a potential for an escalation of privilege. Reference CVE-2017-5727. Description: The Intel® Graphics Drivers for Windows Code can fail to...

Bento4 Excessive Memory Allocation Attempts Vulnerability

Bento4 is a C++ class library and tool for reading and writing ISO-MP4 files. An excessive memory allocation attempt vulnerability exists in the AP4ElstAtom class in Core/Ap4ElstAtom.cpp in Bento4 1.5.1-628, which can be exploited by an attacker to cause a denial of service...

UBUNTU-CVE-2019-6966

An issue was discovered in Bento4 1.5.1-628. The AP4ElstAtom class in Core/Ap4ElstAtom.cpp has an attempted excessive memory allocation related to AP4Array::EnsureCapacity in Core/Ap4Array.h, as demonstrated by mp42hls...

UBUNTU-CVE-2019-6132

An issue was discovered in Bento4 v1.5.1-627. There is a memory leak in AP4DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp when called from the AP4EsdsAtom class in Core/Ap4EsdsAtom.cpp, as demonstrated by mp42aac...

Bento4 Excessive Memory Allocation Attempt Vulnerability

Bento4 is a C++ class library and tool for reading and writing ISO-MP4 files. The AP4StcoAtom class in Core/Ap4StcoAtom.cpp in Bento4 1.5.1-627 suffers from an excessive memory allocation attempt when called from AP4AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp! The vulnerability c...

UBUNTU-CVE-2018-20659

An issue was discovered in Bento4 1.5.1-627. The AP4StcoAtom class in Core/Ap4StcoAtom.cpp has an attempted excessive memory allocation when called from AP4AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp, as demonstrated by mp42hls...

UBUNTU-CVE-2018-20502

An issue was discovered in Bento4 1.5.1-627. There is an attempt at excessive memory allocation in the AP4DataBuffer class when called from AP4HvccAtom::Create in Core/Ap4HvccAtom.cpp...

UBUNTU-CVE-2018-20409

An issue was discovered in Bento4 1.5.1-627. There is a heap-based buffer over-read in AP4AvccAtom::Create in Core/Ap4AvccAtom.cpp, as demonstrated by mp42hls...

Power Management Controller (PMC) Security Advisory

Summary: A potential security vulnerability in power management controller firmware may allow escalation of privilege and/ or information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details CVEID: CVE-2018-3643 Description: A vulnerabili...

Debian DLA-1572-1 : nginx security update

It was discovered that there was a denial of service DoS vulnerability in the nginx web/proxy server. As there was no validation for the size of a 64-bit atom in an MP4 file, this could have led to a CPU hog when the size was 0, or various other problems due to integer underflow when the...

WordPress 4.8.x < 4.8.4 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

WordPress 4.1.x < 4.1.21 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...