SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1744-1)

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. This update adds support for the Hygon Dhyana CPU fate327735. The following security bugs were fixed : CVE-2019-12614: An issue was discovered in dlparparseccproperty in...

Google July Android Security Bulletin Fixes 3 Critical RCE Bugs

Google has released fixes for three critical remote code execution bugs in the media framework of its Android operating system. These flaws could allow a remote attacker to execute arbitrary code. The flaws are part of Google’s July Android Security Bulletin, which included fixes for 12 critical...

CVE-2019-13118

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data...

CVE-2019-13038

modauthmellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL...

openSUSE Security Update : ansible (openSUSE-2019-1635)

This update for ansible fixes the following issues : Ansible was updated to version 2.8.1 : Full changelog is at /usr/share/doc/packages/ansible/changelogs/ - Bugfixes - ACI - DO not encode querystring - ACI modules - Fix non-signature authentication - Add missing directory provided via...

CVE-2019-5835

Object lifecycle issue in SwiftShader in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page...

CVE-2019-5821

Integer overflow in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file...

SUSE SLES12 Security Update : glib2 (SUSE-SU-2019:1596-1)

This update for glib2 fixes the following issues : Security issues fixed : CVE-2019-12450: Fixed an improper file permission when copy operation takes place bsc1137001. CVE-2018-16428: Avoid a NULL pointer dereference bsc1107121. CVE-2018-16429: Fixed out-of-bounds read vulnerability...

SUSE-SU-2019:1596-1 Security update for glib2

This update for glib2 fixes the following issues: Security issues fixed: - CVE-2019-12450: Fixed an improper file permission when copy operation takes place bsc1137001. - CVE-2018-16428: Avoid a NULL pointer dereference bsc1107121. - CVE-2018-16429: Fixed out-of-bounds read vulnerability...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1536-1) (SACK Panic) (SACK Slowness)

The SUSE Linux Enterprise 12 SP4 kernel was updated to 4.12.14 to receive various security and bugfixes. The following security bugs were fixed : CVE-2019-11477: A sequence of SACKs may have been crafted such that one can trigger an integer overflow, leading to a kernel panic. CVE-2019-11479: An...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1534-1) (SACK Panic) (SACK Slowness)

The SUSE Linux Enterprise 12 SP2 kernel version 4.4.121 was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2019-11477: A sequence of SACKs may have been crafted by a remote attacker such that one can trigger an integer overflow, leading to a kernel...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:1532-1) (SACK Panic) (SACK Slowness)

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.180 to receive various security and bugfixes. The following security bugs were fixed : CVE-2019-11477: A sequence of SACKs may have been crafted such that one can trigger an integer overflow, leading to a kernel panic. CVE-2019-11478: It...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1529-1) (SACK Panic) (SACK Slowness)

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2019-11477: A sequence of SACKs may have been crafted such that one can trigger an integer overflow, leading to a kernel panic. CVE-2019-11478: It was possible to...

CVE-2019-12865

In radare2 through 3.5.1, cmdmount in libr/core/cmdmount.c has a double free for the ms command...

A week in security (June 10 – 16)

Last week on Malwarebytes Labs, we revealed to readers the mindset of security pros as to why they lack confidence in their ability to prevent their organizations getting breached. We also reported on Maine Governor Janet Mills implementing the state’s own privacy protections, how Apple can bette...

CVE-2019-12829

radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact, as demonstrated by newstr buffer overflows during replace operations. This affects libr/asm/asm.c and libr/parse/parse.c...

CVE-2019-12802

In radare2 through 3.5.1, the rcccontext function of libr/egg/egglang.c mishandles changing context. This allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact invalid memory access in regglangparsechar; invalid free in rccpusharg...

CVE-2019-5439

A Buffer Overflow in VLC Media Player 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit...

CVE-2019-3888

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

Critical: thunderbird

Issue Overview: Mozilla: Buffer overflow in WebGL bufferdata on Linux CVE-2019-11693 Mozilla: Use-after-free in XMLHttpRequest CVE-2019-11691 Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then...