MGASA-2018-0053 Updated curl packages fix security vulnerability

If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar. The issue pertains to the function that loads cookies into memory, which reads the specified file...

Updated perl packages fix security vulnerability

Jakub Wilk reported a heap buffer overflow flaw in the regular expression compiler, allowing a remote attacker to cause a denial of service via a specially crafted regular expression with the case-insensitive modifier CVE-2017-12837. Jakub Wilk reported a buffer over-read flaw in the regular...

F5 Networks BIG-IP : libcurl vulnerability (K52828640)

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped...

U.K. Man Avoids Jail Time in vDOS Case

A U.K. man who pleaded guilty to launching more than 2,000 cyberattacks against some of the world's largest companies has avoided jail time for his role in the attacks. The judge in the case reportedly was moved by pleas for leniency that cited the man's youth at the time of the attacks and a...

Input validation

Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and consequently gain privileges by leveraging insufficient validation methods and missing cross server side checking mechanisms...

CVE-2017-11319

CVE-2017-11319 applies to Perspective ICM Investigation & Case version 5.1.1.16, where an authenticated remote user can elevate privileges by abusing insufficient input validation and missing cross-server side checks. The root cause is described as inadequate validation in access-control pathways...

Perspective ICM Investigation Elevation of Privilege Vulnerability

Resolver Perspective ICM Investigation&Case is a suite of risk management software from Resolver Canada. A privilege extraction vulnerability exists in Resolver Perspective ICM Investigation&Case version 5.1.1.16. A remote attacker can exploit this vulnerability to change access rights and thereb...

CVE-2017-16820

The csnmpreadtable function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double free in a certain error case, which could lead to a crash or potentially have other impact...

CVE-2017-16820

The csnmpreadtable function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double free in a certain error case, which could lead to a crash or potentially have other impact...

llvm/llvm-special-case-list-fuzzer: Heap-buffer-overflow in p_ere

Detailed report: https://oss-fuzz.com/testcase?key=6496293208719360 Project: llvm Fuzzer: libFuzzerllvmllvm-special-case-list-fuzzer Fuzz target binary: llvm-special-case-list-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x6140000009...

llvm/llvm-special-case-list-fuzzer: Heap-buffer-overflow in p_ere

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=5450169182060544 Project: llvm Fuzzer: libFuzzerllvmllvm-special-case-list-fuzzer Fuzz target binary: llvm-special-case-list-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type:...

llvm/llvm-special-case-list-fuzzer: Heap-buffer-overflow in p_ere

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=5235826691670016 Project: llvm Fuzzer: libFuzzerllvmllvm-special-case-list-fuzzer Fuzz target binary: llvm-special-case-list-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type:...

llvm/llvm-special-case-list-fuzzer: Global-buffer-overflow in p_b_symbol

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=6124359660863488 Project: llvm Fuzzer: libFuzzerllvmllvm-special-case-list-fuzzer Fuzz target binary: llvm-special-case-list-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type:...

GHSA-4WW3-3RXJ-8V6Q actionpack allows remote attackers to bypass intended access restrictions

actionpack/lib/actionview/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action...

IBM Domino KeyView PDF Filter Stream Length Code Execution Vulnerability(CVE-2016-0278)

Description An integer overflow vulnerability present in the PDF filter of KeyView as used by Domino can lead to process crash and possible arbitrary code execution. Tested Versions KeyView 10.16 as used by IBM Domino 9.0.1 Product URLs http://www-03.ibm.com/software/products/en/ibmdomino Details...

October 17, 2017 – Morning Cyber Coffee Headlines – “The Flintstones” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! October 17, 2017 - Headlines Carbon Black in the News: Dark Web Ransomware...

QSC17 Focuses on Digital Transformation’s Challenges and Opportunities

Qualys Security Conference 2017 finds Qualys rapidly advancing in its ongoing quest to seamlessly and transparently thread security into the fabric of IT environments, and to make it essential for digital transformation. At QSC17, happening this week in Las Vegas, Qualys executives will share how...

Fedora 25 : pkgconf (2017-ea57ed609f)

Security fixes - fix crash in edge case where a .pc file has misquoting in a fragment list. Other bug fixes : - fix logic edge case when comparing relocated paths Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenab...

BSA-2017-436

Security Advisory ID : BSA-2017-436 Component : Perl Revision : 2.0: Interim Heap-based buffer overflow in the regular expression compiler in PERL before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service crash via a crafted regular expression with the...

CVE-2015-5070

The 1 filesystem::getwmllocation function in filesystem.cpp and 2 islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to...