CVE-2019-15531

GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTORdviextractmethod in plugins/dviextractor.c...

Security update for MozillaThunderbird (moderate)

openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2019:1990-1 Rating: moderate References: 1137970 1140868 Cross-References: CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11719 CVE-2019-11729...

SUSE-SU-2019:1476-1 Security update for sssd

This update for sssd fixes the following issues: Security issue fixed: - CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation bsc1124194. Non-security issues fixed: - Allow defaults sudoRole without sudoUser attribute bsc1135247 - Missing GPOs director...

CVE-2019-14511

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only...

openSUSE Security Update : the Linux Kernel (openSUSE-2019-1923)

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2019-1125: Fix Spectre V1 variant memory disclosure by speculation over the SWAPGS instruction bsc1139358. - CVE-2019-10207: A NULL pointer dereference was possible i...

openSUSE Security Update : zypper / libzypp and libsolv (openSUSE-2019-1927)

This update for libzypp and libsolv fixes the following issues : Security issues fixed : - CVE-2018-20532: Fixed NULL pointer dereference at ext/testcase.c function testcaseread bsc1120629. - CVE-2018-20533: Fixed NULL pointer dereference at ext/testcase.c function testcasestr2depcomplex in...

CVE-2019-14751

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in an NLTK package ZIP archive that is mishandled during extraction...

MGASA-2019-0225 Updated postgresql packages fix security vulnerabilities

Updated postgresql packages fix security vulnerabilities: Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function, which must itself contain a function call having inexact...

Updated postgresql packages fix security vulnerabilities

Updated postgresql packages fix security vulnerabilities: Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function, which must itself contain a function call having inexact...

OPENSUSE-SU-2019:1927-1 Security update for zypper, libzypp and libsolv

This update for libzypp and libsolv fixes the following issues: Security issues fixed: - CVE-2018-20532: Fixed NULL pointer dereference at ext/testcase.c function testcaseread bsc1120629. - CVE-2018-20533: Fixed NULL pointer dereference at ext/testcase.c function testcasestr2depcomplex in...

Security update for zypper, libzypp and libsolv (moderate)

openSUSE Security Update: Security update for zypper, libzypp and libsolv Announcement ID: openSUSE-SU-2019:1927-1 Rating: moderate References: 1047962 1049826 1053177 1065022 1099019 1102261 1110542 1111319 1112911 1113296 1114908 1115341 1116840 1118758 1119373 1119820 1119873 1120263 1120463...

How Facebook Catches Bugs in Its 100 Million Lines of Code

For the past four years, Facebook has quietly used a homegrown tool called Zoncolan to find bugs in its massive codebase...

CVE-2019-13220

Use of uninitialized stack variables in the startdecoder function in stbvorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose sensitive information by opening a crafted Ogg Vorbis file...

CVE-2019-13218

Division by zero in the predictpoint function in stbvorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file...

CVE-2019-15058

stbimage.h aka the stb image loader 2.23 has a heap-based buffer over-read in stbitgaload, leading to Information Disclosure or Denial of Service...

Lenovo Warns of ThinkPad Bugs, One Unpatched

Dozens of Lenovo’s flagship ThinkPad models are vulnerable to bugs ranging in severity from low to high. Two of the flaws are tied to industry-wide security bulletins, while a medium-severity flaw affects only Lenovo laptops but remains unpatched. The most severe of the three bugs is a...

DejaBlue: New BlueKeep-Style Bugs Mean You Need to Update Windows Now

Vulnerabilities in Microsoft's Remote Desktop Protocol continue to plague the web...

systemd security, bug fix, and enhancement update

219-67.0.1 - do not create utmp update symlinks for reboot and poweroff Orabug: 27854896 - OL7 udev rule for virtio net standby interface Orabug: 28826743 - fix netdev is missing for iscsi entry in /etc/fstab Orabug: 25897792 [email protected] - set 'RemoveIPC=no' in logind.conf as default fo...

tomcat security, bug fix, and enhancement update

0:7.0.76-9 - Resolves: rhbz1641873 CVE-2018-11784 tomcat: Open redirect in default servlet - Resolves: rhbz1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended expo sure of resources - Resolves: rhbz1552374 CVE-2018-1305 tomcat: Late...

NewStart CGSL MAIN 5.04 : firefox Multiple Vulnerabilities (NS-SA-2019-0011)

The remote NewStart CGSL host, running version MAIN 5.04, has firefox packages installed that are affected by multiple vulnerabilities: - Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of these bugs showed evidence of memory corruption and we presume that with enough...