asterisk -- multiple vulnerabilities

The Asterisk project reports: AST-2018-004 - When processing a SUBSCRIBE request the respjsippubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed despite having a fixed limit of 32. If more than 32 Accep...

openSUSE Security Update : transfig (openSUSE-2018-190)

This update for transfig fixes the following issues : - CVE-2017-16899: Do some input sanitizing when reading FIG files to avoid crashes boo1069257 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

Apple Promises Fix for Latest ‘Text Bomb’ Bug As Abuse Spreads

UPDATE Apple said it is working on a fix for the latest text bomb bug that crashes a number of iOS and Mac apps that display specific Telugu language characters. On Monday, it made good on the promise and announced the availability of a patch CVE-2018-4124 for iOS 11.2.6, watchOS 4.2.3, tvOS...

Adobe Acrobat and Reader Heap Overflow (APSB18-02: CVE-2018-4910)

A buffer overflow vulnerability exists in Adobe Acrobat and Reader. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

Adobe Acrobat and Reader Heap Overflow (APSB18-02: CVE-2018-4890)

A buffer overflow vulnerability exists in Adobe Acrobat and Reader. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

Adobe Acrobat and Reader Heap Overflow (APSB18-02: CVE-2018-4904)

A buffer overflow vulnerability exists in Adobe Acrobat and Reader. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

Scientific Linux Security Update : thunderbird on SL6.x, SL7.x i386/x86_64 (20180201)

This update upgrades Thunderbird to version 52.6.0. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running...

RHEL 6 : kernel-rt (RHSA-2018:0181)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0181 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

Debian DLA-1258-1 : wireshark security update

Kamil Frankowicz and Young found that several parsers of wireshark could be crashed by malformed packets. For Debian 7 'Wheezy', these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u6deb7u9. We recommend that you upgrade your wireshark packages. NOTE: Tenable Network Security has...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0233-1)

This update for the Linux Kernel 3.12.61-52111 fixes one issue. The following security issue was fixed : - CVE-2017-15649: net/packet/afpacket.c in the Linux kernel allowed local users to gain privileges via crafted system calls that trigger mishandling of packetfanout data structures, because of...

CVE-2017-15132

A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to...

Security vulnerabilities fixed in Thunderbird 52.6 — Mozilla

An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. A use-after-free vulnerability can occur while editing events in...

Mozilla Firefox < 58 Multiple Vulnerabilities (macOS)

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 58. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes. C Tenable Network Security, Inc. include'compat.inc'; if description...

Mozilla Firefox ESR < 52.6 Multiple Vulnerabilities (macOS)

The version of Mozilla Firefox ESR installed on the remote macOS or Mac OS X host is prior to 52.6. It is, therefore, affected by multiple vulnerabilities, some of which allow code execution and potentially exploitable crashes. C Tenable Network Security, Inc. include"compat.inc"; if description...

Mozilla Firefox < 58.0

The version of Firefox installed on the remote Windows host is prior to 58.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-02 advisory. - Mozilla developers and community members Calixte Denizet, Christian Holler, Alex Gaynor, Yoshi Huang, Bob Clary, Nils...

SUSE-SU-2018:0179-1 Security update for wireshark

This update for wireshark to version 2.2.12 fixes the following issues: - CVE-2018-5334: IxVeriWave file could crash bsc1075737 - CVE-2018-5335: WCP dissector could crash bsc1075738 - CVE-2018-5336: Multiple dissector crashes bsc1075739 - CVE-2017-17935: Incorrect handling of '\n' in filereadline...

Design/Logic Flaw

In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. This was addressed in epan/tvbparse.c by limiting the recursion depth...

Debian: Security Advisory (DLA-877-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 6 / 7 : thunderbird (RHSA-2018:0061)

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:0061 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 52.5.2. Security Fixes:...

Double-Free Vulnerability

CocoaLumberjack is vulnerable to a double-free error. The DDLog.m file calls the free function twice on the same memory address. This can lead to a buffer overflow and application crashes...