Ubuntu 16.04 ESM : Linux kernel (AWS) vulnerabilities (USN-5884-1)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5884-1 advisory. Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some...

Android voice chat app with 5m installs leaked user chats

By Habiba Rashid The voice chat app under discussion is OyeTalk, which is available for Android and iOS devices and is operated from Pakistan. This is a post from HackRead.com Read the original post: Android voice chat app with 5m installs leaked user chats...

Important: kernel

Issue Overview: A flaw in the processing of received ICMP errors ICMP fragment needed and ICMP redirect in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization...

K71080411: Linux kernel vulnerability CVE-2021-4155

Security Advisory Description A data leak flaw was found in the way XFSIOCALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. CVE-2021-4155 Impact Ther...

postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions

A flaw was found in org.postgresql. This issue allows the creation of a temporary file when using PreparedStatement.setTextint, InputStream and PreparedStatemet.setByteaint, InputStream. This could allow a user to create an unexpected file available to all users, which could end in unexpected...

Mozilla: Email user account in indexacao waybackurl

The indexation of a large number of user emails on the Internet Archive in the Mozilla accounts service, accounts.firefox.com, was discovered. The presence of the leaked data was reported to Mozilla, but it did not meet the criteria for a security risk due to the lack of a current flaw in a Mozil...

A week in security (February 13 - 19)

Last week on Malwarebytes Labs: What is AI good at and what the heck is it, actually, with Josh Saxe: Lock and Code S04E04 Malwarebytes recognized as endpoint security leader by G2 CISA issues alert with South Korean government about DPRK's ransomware antics Jailbreaking ChatGPT and other large...

QR code generator My QR Code leaks users’ login data and addresses

By Waqas My QR Code was informed about the leak almost two weeks ago, yet it failed to respond or secure its server. This is a post from HackRead.com Read the original post: QR code generator My QR Code leaks users login data and addresses...

UBUNTU-CVE-2021-32419

An issue in Schism Tracker v20200412 fixed in v.20200412 allows attacker to obtain sensitive information via the fmtmtmloadsong function in fmt/mtm.c...

CVE-2023-24964

IBM InfoSphere Information Server 11.7 could allow a local user to obtain sensitive information from a log files. IBM X-Force ID: 246463...

AI Image Editing Tool Cutout Leaked User Images and Data

By Habiba Rashid In total, the Cutout-owned Elasticsearch server leaked a whopping 9 GB worth of customer data. This is a post from HackRead.com Read the original post: AI Image Editing Tool Cutout Leaked User Images and Data...

SUSE CVE-2004-0814

Multiple race conditions in the terminal layer in Linux 2.4.x, and 2.6.x before 2.6.9, allow 1 local users to obtain portions of kernel data via a TIOCSETD ioctl call to a terminal interface that is being accessed by another thread, or 2 remote attackers to cause a denial of service panic by...

SUSE CVE-2008-1290

ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion SVN commits, which allows remote attackers to obtain sensitive information...

SUSE CVE-2009-0844

The getinputtoken function in the SPNEGO implementation in MIT Kerberos 5 aka krb5 1.5 through 1.6.3 allows remote attackers to cause a denial of service daemon crash and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read...

SUSE CVE-2010-0084

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.225 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2010-0091...

SUSE CVE-2011-0992

Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service plugin crash or obtain sensitive information via vectors related to member data in a resurrected MonoThread instance...

SUSE CVE-2011-4690

Opera 11.60 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code...

SUSE CVE-2011-4691

Google Chrome 15.0.874.121 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code...

SUSE CVE-2013-4959

Puppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the "no-cache" setting, which might allow local users to obtain sensitive information such as 1 host name, 2 MAC address, and 3 SSH keys via the web browser cache...

SUSE CVE-2013-7281

The dgramrecvmsg function in net/ieee802154/dgram.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a 1 recvfrom, 2...