Security Bulletin: Vulnerabilities in IBM Runtime Environments Java Technology Edition, Versions 7 & 8, IBM SDK, Java Technology Edition Version 8 and Eclipse OpenJ9 Affect Transformation Extender

Summary There are vulnerabilities in IBM Runtime Environments Java Technology Edition, Versions 7 and 8, IBM SDK, Java Technology Edition Version 8 and Eclipse Open J9 that affect IBM Transformation Extender. Vulnerability Details CVEID: CVE-2018-1890 Description: On the AIX platform, the IBM Jav...

SUSE SLED15 / SLES15 Security Update : cups (SUSE-SU-2019:3030-1)

This update for cups fixes the following issues : CVE-2019-8675: Fixed a stack-based buffer overflow in libcups's asn1gettype functionbsc1146358. CVE-2019-8696: Fixed a stack-based buffer overflow in libcups's asn1getpacked function bsc1146359. Note that Tenable Network Security has extracted the...

CVE-2019-18240

In Fuji Electric V-Server 4.0.6 and prior, several heap-based buffer overflows have been identified, which may allow an attacker to remotely execute arbitrary code...

CVE-2019-18240

In Fuji Electric V-Server 4.0.6 and prior, several heap-based buffer overflows have been identified, which may allow an attacker to remotely execute arbitrary code...

EulerOS 2.0 SP5 : gpgme (EulerOS-SA-2019-2125)

According to the versions of the gpgme package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - GnuPG Made Easy GPGME is a library designed to make access to GnuPG easier for applications. It provides a high-level crypto API for encryption,...

EulerOS 2.0 SP5 : libsndfile (EulerOS-SA-2019-2208)

According to the versions of the libsndfile package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In libsndfile version 1.0.28, an error in the 'aiffreadchanmap' function aiff.c can be exploited to cause an out-of-bounds read memory access...

Amazon Kindle, Embedded Devices Open to Code-Execution

Multiple vulnerabilities have been found in Das U-Boot, a universal bootloader commonly used in embedded devices like Amazon Kindles, ARM Chromebooks and networking hardware. The bugs could allow attackers to gain full control of an impacted device’s CPU and modify anything they choose. Researche...

RHEL 8 : edk2 (RHSA-2019:3338)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3338 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware f...

Mozilla Firefox ESR < 24.6 Multiple Vulnerabilities

Binary data 701245.prm...

Mozilla Firefox ESR < 24.1 Multiple Vulnerabilities

Binary data 701256.prm...

Moderate: Red Hat Security Advisory: edk2 security, bug fix, and enhancement update

An update for edk2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Stack overflow

Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparse parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point packetdatapptr i...

CVE-2019-17212

Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparse parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point packetdatapptr i...

CVE-2019-17212

Arm Mbed OS CoAP library (mbed-coap) version 5.14.0 contains a buffer overflow in the CoAP parser sn_coap_parser_options_parse(), where pointer bounds are not consistently enforced inside loops, enabling heap- or stack-based overflows when processing crafted CoAP packets. The root cause is lack o...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE (SUSE-SU-2019:2871-1)

This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues : Changes in MozillaFirefox : Security issues fixed : CVE-2019-15903: Fixed a heap overflow in the expat library bsc1149429. CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB...

CVE-2013-2075

Multiple buffer overflows in the 1 R5RS char-ready, 2 tcp-accept-ready, and 3 file-select procedures in Chicken through 4.8.0.3 allows attackers to cause a denial of service crash by opening a file descriptor with a large integer value. NOTE: this issue exists because of an incomplete fix for...

CVE-2013-2075

Multiple buffer overflows in the 1 R5RS char-ready, 2 tcp-accept-ready, and 3 file-select procedures in Chicken through 4.8.0.3 allows attackers to cause a denial of service crash by opening a file descriptor with a large integer value. NOTE: this issue exists because of an incomplete fix for...

CVE-2013-2075

CVE-2013-2075 describes multiple buffer overflows in Chicken (up to 4.8.0.3) affecting the (1) R5RS char-ready, (2) tcp-accept-ready, and (3) file-select procedures. The issue enables a denial-of-service (crash) when a file descriptor with a large integer value is opened, and is noted as stemming...

CVE-2013-2075

Multiple buffer overflows in the 1 R5RS char-ready, 2 tcp-accept-ready, and 3 file-select procedures in Chicken through 4.8.0.3 allows attackers to cause a denial of service crash by opening a file descriptor with a large integer value. NOTE: this issue exists because of an incomplete fix for...

CVE-2013-2075

Multiple buffer overflows in the 1 R5RS char-ready, 2 tcp-accept-ready, and 3 file-select procedures in Chicken through 4.8.0.3 allows attackers to cause a denial of service crash by opening a file descriptor with a large integer value. NOTE: this issue exists because of an incomplete fix for...