SUSE-SU-2019:13982-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: Security issues fixed: - CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets bsc1128490. - CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet bsc1128492. -...

PT-2019-1601 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in handling requests in the Windows SMB protocol implementation, which can be exploited by a remote attacker to gain unauthorized access to protected...

The vulnerability of microprogrammed software in Siemens Simatic S7-400 programmable logic controllers is related to errors in checking input data by Ethernet, PROFIBUS, and MPI interfaces. This allows a malicious actor to trigger a service failure.

The vulnerability of microprogrammed programmable logic controllers from Siemens Simatic S7-400 is related to errors in the validation of input data by Ethernet, PROFIBUS, and MPI interfaces. Exploiting this vulnerability can allow an attacker to cause malfunctions in the system by sending a...

PT-2019-1559 · Cisco · Nexus 7000 Series Switches +12

Name of the Vulnerable Software and Affected Versions: Cisco FXOS Software versions prior to 2.0.1.201, 2.2.2.54, and 2.3.1.75 Cisco NX-OS Software versions prior to 7.03I71 on Nexus 3000 Series Switches Cisco NX-OS Software versions prior to 7.03I72 on Nexus 3500 Platform Switches Cisco NX-OS...

The vulnerability of the programmable logic integrated circuit that controls the input buffer of Cisco Firepower 9000 Series software-based network interfaces allows a intruder to cause a service failure.

The vulnerability of the programmable logic integrated circuit that controls the input buffer of Cisco Firepower 9000 Series software lies in the handling of various types of input packets. Exploiting this vulnerability can allow an attacker to trigger a Denial-of-Service attack by sending a...

The vulnerability of Siemens’ communication module software, related to insufficient validation of input data, allows a perpetrator to trigger a service failure of the module.

The vulnerability of Siemens’ communication module’s microprogramming software is related to insufficient verification of input data. Exploiting this vulnerability can allow attackers to cause malfunctions in the module by sending specially crafted packets to port 102/TCP...

The vulnerability of Siemens’ communication module software, related to insufficient validation of input data, allows a perpetrator to trigger a service failure of the module.

The vulnerability of Siemens’ communication module’s microprogramming software is related to insufficient verification of input data. Exploiting this vulnerability can allow attackers to cause malfunctions in the module by sending specially crafted packets to port 102/TCP...

Remote code execution

A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server, aka 'Windows DHCP Server Remote Code Execution Vulnerability'...

Moxa IKS and EDS Uncontrolled Resource Consumption Vulnerability

Moxa IKS and EDS is a series of industrial switches introduced by Moxa. An uncontrolled resource consumption vulnerability exists in the Moxa IKS and EDS series. A remote authenticated attacker could exploit this vulnerability via specially crafted packets to cause a denial of service, which coul...

The vulnerability of the SMBv2 component of the Windows operating system, allowing a hacker to execute arbitrary code

The vulnerability of the SMBv2 component of the Windows operating system is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code by sending a specially crafted package to the SMBv2 server...

The vulnerability of the IEC 61850-MMS protocol processor in Siemens network equipment’s microprogramming software allows a perpetrator to induce a service failure.

The vulnerability of the IEC 61850-MMS protocol processor in Siemens’ micro-programmed network equipment is related to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending specially crafted packets to port...

BusyBox Project BusyBox udhcp Option Out of Bounds Read (CVE-2018-20679)

An out-of-bounds read vulnerability has been reported in the udhcp module of BusyBox. This vulnerability is due to insufficient validation of the length of certain options in a DHCP packets. A remote attacker could exploit this vulnerability by sending maliciously crafted messages to a DHCP clien...

Cisco Firepower 9000 Series Resource Management Error Vulnerability

Cisco Firepower 9000 Series is a 9000 series firewall appliance from Cisco USA. The Cisco Firepower 9000 Series has a resource management error vulnerability that originates from a logic error in the field programmable gate array. An attacker could cause a denial of service by sending specially...

The vulnerability of Siemens’ PROFINET DCP software, related to insufficient validation of input data, allows a intruder to trigger a service failure.

The vulnerability of Siemens’ PROFINET DCP software is related to insufficient verification of input data. Exploiting this vulnerability can allow attackers to cause service failures in the local Ethernet segment using specially crafted PROFINET DCP broadcast packets...

Vulnerability of the Server component: The Optimizer component of the MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the MySQL Server component of the database management system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause the application to become unresponsive or to crash, by using specially crafted network packets...

The vulnerability of the InnoDB component of the MySQL Database Server management system, which allows a hacker to cause a service failure.

The vulnerability of the InnoDB component in the MySQL Database Management System is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to cause the application to become unresponsive or to crash. This occurs through the use of...

Vulnerability of the Server component: The MySQL Server database management system’s Parser component, which allows a hacker to cause a service failure.

The vulnerability of the MySQL Server component of the database management system involves deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause the application to become unresponsive or to crash, by using specially crafted network packets...

The vulnerability of the JunOS operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the JunOS operating system’s kernel is related to errors in processing packets destined for another address. Exploiting this vulnerability can allow an attacker to trigger a kernel error and a service failure by sending specially crafted packets from external control interfac...

The vulnerability of Siemens Sinumerik programmable logic controllers lies in the integer overflow that occurs in the VNC server. This allows a perpetrator to execute arbitrary code with privileged privileges.

The vulnerability of Siemens Sinumerik programmable logic controllers is related to a numerical overflow in the VNC server. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with privileged privileges by sending specially crafted packets to port 5900/TCP...

The vulnerability of the ntpd daemon, which implements the NTP synchronization protocol, is related to errors in processing input data. This allows a perpetrator to cause a service failure.

The vulnerability of the ntpd daemon, which implements the NTP synchronization protocol, is related to errors in processing input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by sending specially crafted packets...