Security Bulletin: Vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020

Summary There are vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020 us by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-2604 DESCRIPTION: An unspecified vulnerability in Java SE could allow an unauthenticated attacker ...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM InfoSphere Information Server

Summary There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition, Versions 7 and 8 that are used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK updates in July 2019. Vulnerability Details CVEID: CVE-2019-2786 DESCRIPTION: An...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

Palo Alto Networks PAN-OS Input Validation Error Vulnerability (CNVD-2020-31585)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. An input validation error vulnerability exists in the GlobalProtect component of Palo Alto Networks PAN-OS. The vulnerability originates from a network system or product that does not...

SAP Adaptive Server Enterprise Information Disclosure Vulnerability (CNVD-2020-29753)

SAP Adaptive Server Enterprise is a relational database server from SAP. An information disclosure vulnerability exists in SAP Adaptive Server Enterprise. An attacker could exploit this vulnerability to obtain account credentials, manipulate system data, and impact system availability...

SAP Business Objects Business Intelligence Platform Input Validation Error Vulnerability

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. An input validation error vulnerability exists in SAP Business Object...

The vulnerability of the is_wlc_event_frame function in the Broadcom brcmfmac WiFi kernel driver for the Linux operating system allows a hacker to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of the iswlceventframe function in the Broadcom brcmfmac WiFi driver for Linux operating systems is related to insufficient input data validation. Exploiting this vulnerability can allow an attacker to gain unauthorized access to information and compromise its integrity and...

The vulnerability of the brcmf_wowl_nd_results function in Broadcom’s brcmfmac WiFi kernel for Linux operating systems allows a hacker to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of the brcmfwowlndresults function in Broadcom’s brcmfmac WiFi kernel for Linux operating systems is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to information and compromise its...

CVE-2020-6247

SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service. Using a specially crafted request, the attacker can crash or flood the Central Management Server, thereby impacting system availability...

CVE-2020-6252

Under certain conditions SAP Adaptive Server Enterprise Cockpit, version 16.0, allows an attacker with access to local network, to get sensitive and confidential information, leading to Information Disclosure. It can be used to get user account credentials, tamper with system data and impact syst...

CVE-2020-6247

SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service. Using a specially crafted request, the attacker can crash or flood the Central Management Server, thereby impacting system availability...

kernel: out-of-bounds read in set_fdc in drivers/block/floppy.c

An out-of-bounds OOB memory access flaw was found in the floppy driver module in the Linux kernel. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability i...

Mozilla: Use-after-free during worker shutdown

A flaw was found in Mozilla Firefox and Thunderbird. When running shutdown code for Web Worker, a race condition occurs leading to a use-after-free memory flaw that could lead to an exploitable crash. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server April 2020 CPU plus deferred CVE-2019-2949 and CVE-2020-2654

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These might affect some configurations of IBM WebSphere Application Server Traditional, IBM WebSphere Application Server Liberty and IBM WebSphere Applicatio...

PT-2020-6395 · C-Ares +1 · C-Ares +1

Name of the Vulnerable Software and Affected Versions: c-ares lib version 1.16.0 Description: The issue is related to a possible use-after-free and double-free in the c-ares library. This occurs when ares destroy is called before ares getaddrinfo completes. The flaw could allow an attacker to cra...

CVE-2020-2925

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PS. Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of...

CVE-2020-2923

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2020-2904

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2020-2893

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of thi...

CVE-2020-2759

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Replication. Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...