Scientific Linux Security Update : apr on SL6.x, SL7.x i386/x86_64 (20171129)

Security Fixes : - An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak. CVE-2017-12613 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text i...

CentOS 6 / 7 : apr (CESA-2017:3270)

An update for apr is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

apr: Out-of-bounds array deref in apr_time_exp*() functions

An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak...

Important: Red Hat Security Advisory: apr security update

An update for apr is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

apr security update

CentOS Errata and Security Advisory CESA-2017:3270 An update for apr is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whic...

Fedora 26 : varnish (2017-5525b6cb5a)

Security fix for CVE-2017-8807: This fixes a possible data leak in stevedore transient objects in varnishd. Upstream reports: 'It is not inconceiveable that an attack can provoke this situation on vulnerable varnishd instances, where the leaked memory contains confidential data and therefore we...

Fedora 25 : varnish (2017-8575fbfe90)

Security fix for CVE-2017-8807: This fixes a possible data leak in stevedore transient objects in varnishd. Upstream reports: 'It is not inconceiveable that an attack can provoke this situation on vulnerable varnishd instances, where the leaked memory contains confidential data and therefore we...

November 20, 2017 – Morning Cyber Coffee Headlines – “Thanksgiving Week” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! November 20, 2017 - Headlines Carbon Black in the News: Why business is booming...

ZEIT Next.js Directory Traversal Vulnerability

Next.js is a minimalist server-side rendering framework for React applications. A directory traversal vulnerability exists in ZEIT Next.js versions prior to 2.4.1 under the /next and /static request namespaces. An attacker can exploit this vulnerability to obtain sensitive information...

MGASA-2017-0417 Updated apr packages fix security vulnerability

An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak CVE-2017-12613...

Updated apr packages fix security vulnerability

An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak CVE-2017-12613...

HackerOne: Introspection query leaks sensitive graphql system information.

Summary: Interospection query leaks sensitive data. Introduction As we know graphql was initially developed and used by facebook as an internal query language and so the features of graphql mostly revolve around internal and development areas. Graphql executes queries using a type system with the...

Mozilla: Cross-origin URL information leak through Resource Timing API (MFSA 2017-25)

The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox 57, Firefox ESR 52.5, and Thunderbird 52.5...

CVE-2017-9701

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing OEM unlock/unlock-go fastboot commands data leak may occur, resulting from writing uninitialized stack structure to non-volatile memory...

CVE-2017-11028

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the ISP Camera driver, the contents of an arbitrary kernel address can be leaked to userspace by the function msmispgetstreamcommondata...

Design/Logic Flaw

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing OEM unlock/unlock-go fastboot commands data leak may occur, resulting from writing uninitialized stack structure to non-volatile memory...

CVE-2017-9701

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing OEM unlock/unlock-go fastboot commands data leak may occur, resulting from writing uninitialized stack structure to non-volatile memory...

CVE-2017-9701

Technical details about CVE-2017-9701 are not publicly available in the provided connected documents; the information comes from the initial description only. Monitor for updates.

ECS Online Learning System v3.1.0 SQL Injection Vulnerability in Frontend ShitiController.class.php Page

E-learning Online Learning System is an online learning platform system developed with thinkphp+bootstrap as the framework. A SQL injection vulnerability exists in the ShitiController.class.php page in the frontend of ECS Online Learning System v3.1.0. An attacker can exploit this vulnerability t...

FreeBSD -- Kernel data leak via ptrace(PT_LWPINFO)

Problem Description: Not all information in the struct ptracelwpinfo is relevant for the state of any thread, and the kernel does not fill the irrelevant bytes or short strings. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of informatio...