Security Bulletin: Vulnerabilities in OpenSSL affect IBM Aspera Transfer Cluster Manager, Faspex on Demand, Server on Demand, Application on Demand, and Azure on Demand (CVE-2016-6302 CVE-2016-6304 CVE-2016-6303 CVE-2016-2182 CVE-2016-2177 ...)

Summary OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL is used by IBM Aspera Transfer Cluster Manager, IBM Aspera Faspex on Demand, IBM Aspera Server on Demand, IBM Aspera Application on Demand, and IBM Aspera Azure on Demand. IBM Aspera Transf...

The vulnerability of Microsoft Edge browser and the ChakraCore JavaScript engine lies in memory object handling errors, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft Edge browser and the JavaScript scenario handler ChakraCore arises due to an operation going beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially crafted web page...

PT-2018-2546

Name of the Vulnerable Software and Affected Versions Wireshark versions 2.4.0 through 2.4.10 Wireshark versions 2.6.0 through 2.6.4 Description The issue is related to a buffer boundary problem in the IxVeriWave file parser, which could cause a crash. It is associated with a reading beyond the...

The vulnerability of the rds_message_alloc_sgs() function in the Linux operating system allows a hacker to perform write operations beyond the buffer boundaries in memory.

The vulnerability of the rdsmessageallocsgs function in the Linux operating system is related to insufficient checks on the data used by the direct memory access mechanism. Exploiting this vulnerability could allow an attacker to write data beyond the buffer boundaries in memory...

The vulnerability of the Data-in-Motion process of the Cisco IOx software platform allows a malicious actor to execute arbitrary code with root privileges.

The vulnerability of the Data-in-Motion process of the Cisco IOx software platform arises from operations that occur outside the buffer boundaries on the stack inadequate checking of buffer boundaries during the registration of the DMo process. Exploiting this vulnerability allows a malicious...

The vulnerability of the Android operating system from the CAF repository exists due to memory buffer cleanup errors, allowing attackers to cause memory corruption.

The vulnerability of the Linux operating system’s Android kernel from the CAF repository involves the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to cause memory corruption by using an incorrect length for memory buffer...

The vulnerability of the Oniguruma library, which arises from the use of an uninitialized variable, allows a hacker to perform read operations beyond the buffer boundary in dynamic memory.

The vulnerability of the Oniguruma library exists due to incorrect processing of reg-dmin in the forwardsearchrange function. This allows the use of an uninitialized variable during data reading from the buffer. Exploiting this vulnerability could enable a malicious actor to read beyond the...

The vulnerability of the WritePICONImage function in the coder/xpm.c file of the console-based graphic editor ImageMagick allows a hacker to cause a system failure.

The vulnerability of the WritePICONImage function in the coder/xpm.c file of the console-based graphic editor ImageMagick arises from the execution of an operation outside the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to cause a service failure loss of...

The vulnerability of JavaScript handlers in the Microsoft Edge browser for the Windows operating system, allowing a perpetrator to execute arbitrary code

The vulnerability of Microsoft Edge’s JavaScript handlers arises from an operation going beyond the buffer boundaries due to a memory object processing error. Exploiting this vulnerability allows a remote attacker to execute arbitrary code in the context of the current user...

The vulnerability in the Chakra JavaScript engine of the Microsoft Edge browser allows a hacker to execute arbitrary code or trigger memory corruption.

The vulnerability in the Chakra JavaScript engine of Microsoft Edge occurs due to an operation going beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause memory corruption...

PT-2017-4145

Name of the Vulnerable Software and Affected Versions OpenEXR version 2.2.0 Description The issue is related to an invalid read in the getBits function, which could cause the application to crash. It is associated with a buffer data boundary read issue in the OpenEXR library. Exploitation of this...

PT-2018-4901

Name of the Vulnerable Software and Affected Versions PowerDNS Authoritative Server versions up to and including 4.0.1 PowerDNS Authoritative Server versions up to and including 3.4.10 Description The issue allows an authorized user to crash the server by inserting a specially crafted record in a...

The vulnerability of the Flash Player software, which allows a violator to execute arbitrary code

The vulnerability of the RegExp class arises due to a violation of the buffer’s initial boundary. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

The vulnerability of the Flash Player software, which allows a violator to execute arbitrary code

The vulnerability of the RegExp class arises due to a violation of the buffer’s initial boundary. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

PT-2016-2960 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 23.0.0.207 and earlier Adobe Flash Player versions 11.2.202.644 and earlier Description: The issue is caused by a buffer boundary violation in the RegExp class of the Flash Player platform. Exploitation of this iss...

PT-2016-2959 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 23.0.0.207 and earlier Adobe Flash Player versions 11.2.202.644 and earlier Description: The issue is caused by a buffer boundary error in the RegExp class of the Flash Player platform, related to the backtrack...

PT-2016-2958 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 23.0.0.207 and earlier Adobe Flash Player versions 11.2.202.644 and earlier Description: The issue is caused by a buffer boundary violation in the RegExp class for specific search strategies in the Flash Player...

openssl -- denial of service

Mitre reports: OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service integer overflow and application crash or possibly have unspecified other impact by leveraging unexpected malloc behavior,...

Mandriva Linux Security Advisory : libtasn1 (MDVSA-2015:116)

Updated libtasn1 packages fix security vulnerabilities : Multiple buffer boundary check issues were discovered in libtasn1 library, causing it to read beyond the boundary of an allocated buffer. An untrusted ASN.1 input could cause an application using the library to crash CVE-2014-3467. It was...

jasper -- multiple vulnerabilities

oCERT reports: The library is affected by a double-free vulnerability in function jasiccattrvaldestroy as well as a heap-based buffer overflow in function jp2decode. A specially crafted jp2 file can be used to trigger the vulnerabilities. oCERT reports: The library is affected by an off-by-one...