Scientific Linux Security Update : kernel on SL7.x x86_64 (20191205)

Security Fixes : - Kernel: KVM: OOB memory access via mmio ring buffer CVE-2019-14821 - kernel: local attacker can trigger multiple use-after-free conditions results in privilege escalation CVE-2019-15239 Bug Fixes : - On SL 7.7 kernel SCSI VPD information for NVMe drives is missing breaks...

Mozilla Firefox ESR < 68.3

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-37 advisory. - Mozilla developers Christoph Diehl, Nathan Froyd, Jason Kratzer, Christian Holler, Karl Tomlinson, Tyson...

Mozilla Firefox < 71.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 71.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-36 advisory. - Mozilla developers and community members Philipp, Diego Calleja, Mikhail Gavrilov, Jason Kratzer, Christian...

Mozilla: Buffer overflow in plain text serializer

The plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 68.3, Firefox ESR 68.3, and Firefox 71...

Mozilla: Buffer overflow in plain text serializer

The plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 68.3, Firefox ESR 68.3, and Firefox 71...

Buffer overflow vulnerability in multiple Mozilla products (CNVD-2020-03240)

Mozilla Firefox and others are products of the Mozilla Foundation in the U.S.A. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser.Mozilla Thunderbird is a suite of e-mail client software separate from the Mozilla Application...

Unspecified Vulnerability in F5 SSL Orchestrator

F5 SSL Orchestrator is an all-in-one appliance solution for SSL infrastructures from F5, Inc. that provides policy-based dynamic decryption, encryption and traffic control. A security vulnerability exists in F5 SSL Orchestrator versions 15.0.0 through 15.0.1 and 14.0.0 through 14.1.2, which can b...

UBUNTU-CVE-2019-19221

In Libarchive 3.4.0, archivewstringappendfrommbs in archivestring.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive...

Hp Intelligent Management Center Buffer Overflow (CVE-2018-7114)

A buffer overflow vulnerability exists in HP intelligent management center. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

FreeBSD -- Intel CPU Microcode Update

Starting with version 1.26, the devcpu-data port/package includes updates and mitigations for the following technical and security advisories depending on CPU model. Intel TSX Updates TAA CVE-2019-11135 Voltage Modulation Vulnerability CVE-2019-11139 MDCLEAR Operations CVE-2018-12126 CVE-2018-121...

SUSE-SU-2019:2727-2 Security update for dhcp

This update for dhcp fixes the following issues: Secuirty issue fixed: - CVE-2019-6470: Fixed DHCPv6 server crashes bsc1134078. Bug fixes: - Add compile option --enable-secs-byteorder to avoid duplicate lease warnings bsc1089524. - Use IPv6 when called as dhclient6, dhcpd6, and dhcrelay6 bsc11365...

EulerOS 2.0 SP3 : elfutils (EulerOS-SA-2019-2272)

According to the versions of the elfutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - dwarfgetaranges in dwarfgetaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service heap-based...

Code injection

In Linux 2.6 before 2.6.23, the TRACEIRQSON function in iretexc calls a C function without ensuring that the segments are set properly. The kernel's %fs needs to be restored before the call in TRACEIRQSON and before enabling interrupts, so that "current" references work. Without this, "current"...

Microsoft works with researchers to detect and protect against new RDP exploits

On November 2, 2019, security researcher Kevin Beaumont reported that his BlueKeep honeypot experienced crashes and was likely being exploited. Microsoft security researchers collaborated with Beaumont as well as another researcher, Marcus Hutchins, to investigate and analyze the crashes and...

Mozilla Firefox ESR < 17.0.9 Multiple Vulnerabilities

Binary data 701237.prm...

USN-4171-2 apport vulnerabilities

USN-4171-1 fixed several vulnerabilities in apport. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Kevin Backhouse discovered Apport would read its user-controlled settings file as the root user. This could be used by a local attacker to possibly...

JavaScriptCore GetterSetter Type Confusion

JSC: GetterSetter type confusion during DFG compilation The following JavaScript program, found by Fuzzilli and slightly modified, crashes JavaScriptCore built from HEAD and the current stable release /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc: let notAGetterSetter =...

The Pirate Bay was recently down for over a week due to a DDoS attack

It seems like the prolonged downtime and technical difficulties faced by The Pirate Bay over the past several weeks were due to a series of distributed denial of service DDoS attacks against the widely-popular torrent website by malicious actors. For those unaware, The Pirate Bay was down for mor...

UBUNTU-CVE-2019-11483

Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user...

CVE-2017-10167

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...