Security Bulletin: Vulnerabilities in glibc affect ”WebSphere Message Broker v8 HVE” and “IBM Integration Bus V9 HVE” (CVE-2014-5119)

Summary A glibc vulnerability was disclosed in September 2014. This bulletin addresses this vulnerability that has been referred to as “glibc: off-by-one error leading to a heap-based buffer overflow flaw in gconvtranslitfind “. glibc is shipped with ”WebSphere Message Broker v8 HVE” and “IBM...

Security Bulletin: IBM Integration Bus Manufacturing pack is affected by Cross-site scripting

Summary IBM Integration Bus Manufacturing pack is vulnerable to cross-site scripting XSS Vulnerability Details CVE-ID: CVE-2014-4820 CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95457 for the current score CVSS Environmental Score: Undefined...

Security Bulletin: Possible security exposures within IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus (WESB) - IBM SDK for Java April 2014 CPU

Summary There are multiple security vulnerabilities within the version of IBM WebSphere Application Server that is provided with WebSphere Enterprise Service Bus Vulnerability Details These security vulnerabilities are all fixed with available interim fixes and are targeted for specific WebSphere...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with WebSphere Enterprise Service Bus (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of WebSphere Enterprise Service Bus. Information about security vulnerabilities that affect IBM DB2 have been published in a security bulletin Vulnerability Details Consult the security bulletin IBM DB2 is impacted by multiple TLS/SSL security...

Security Bulletin: Class loader manipulation vulnerability in IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus Registry Edition (CVE-2014-0114)

Summary A class loader manipulation vulnerability exists in the Apache Struts 1, which is used by IBM WebSphere Application Server and is provided with WebSphere Enterprise Service Bus Registry Edition Vulnerability Details This security vulnerability is fixed with available interim fixes and are...

Google Android Qualcomm bus driver privilege access control vulnerability

Android on Google Pixel and Nexus is a Linux-based open source operating system for Google Pixel and Nexus smartphones developed by Google and the Open Handheld Alliance OHA.Qualcomm bus driver is one of the The Qualcomm bus driver is one of the bus drivers. A privilege access control vulnerabili...

CVE-2017-15843

Due to a race condition in a bus driver, a double free in msmbusfloorvotecontext can potentially occur in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2017-15843

CVE-2017-15843 describes a race condition in the Qualcomm bus driver, specifically msm_bus_floor_vote_context(), which can lead to a double-free in CAF Android-for-MSM builds on Linux kernels. The vulnerability affects Android releases that use the affected bus driver; CVSS data indicates Local a...

DEBIAN-CVE-2018-5814

In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets...

JB Bus SQL Injection Vulnerability in Joomla!

Joomla! is an open source content management system CMS.JB Bus is a component that creates functionality for online bus booking websites. Joomla JB Bus suffers from a SQL injection vulnerability. An attacker could use this vulnerability to corrupt the application, access or modify data, or exploi...

Vgate iCar 2 Wi-Fi OBD2 Dongle Unauthenticated Access Vulnerability

Vgate iCar 2 Wi-Fi OBD2 Dongle is an automotive fault detection device from VgateTechnology, China. A security vulnerability exists in the Vgate iCar 2 Wi-Fi OBD2 Dongle. The vulnerability can be exploited by an attacker to access the data bus e.g. CAN via a local Wi-Fi network...

lastore-daemon D-Bus Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in lastore-daemon D-Bus. An attacker can exploit the vulnerability to perform an elevation of privilege and gain administrator user access...

Debian DLA-1387-1 : cups security update

CVE-2017-18248 It was found that by submitting a print job with an invalid username, the CUPS server can be crashed, when D-Bus support is enabled which is the case for Debian. For Debian 7 'Wheezy', these problems have been fixed in version 1.5.3-5+deb7u8. We recommend that you upgrade your cups...

Debian: Security Advisory (DLA-1387-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1387-1] cups security update

Package : cups Version : 1.5.3-5+deb7u8 CVE ID : CVE-2017-18248 CVE-2017-18248 It was found that by submitting a print job with an invalid username, the CUPS server can be crashed, when D-Bus support is enabled which is the case for Debian. For Debian 7 "Wheezy", these problems have been fixed in...

Oracle Retail Applications Retail Integration Bus Component Unauthorized Operation Vulnerability

Oracle Retail Applications is a set of retail application store solutions from Oracle Corporation. Retail Integration Bus is one of the components that provides real-time messaging for retailers' surveys. A security vulnerability exists in the RIB Kernal Apache Commons Collections subcomponent of...

[SECURITY] Fedora 27 Update: PackageKit-1.1.10-1.fc27

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distro, cross-architecture API...

[SECURITY] Fedora 28 Update: PackageKit-1.1.10-1.fc28

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distro, cross-architecture API...

Chrome V8 JIT - Arrow Function Scope Fixing Bug

/ When the parser parses the parameter list of an arrow function contaning destructuring assignments, it can't distinguish whether the assignments will be actually in the parameter list or just assignments until it meets a "=" token. So it first assigns the destructuring assignments to the outer...

Ubuntu: Security Advisory (USN-3630-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...