CVE-2018-1000007

CVE-2018-1000007 affects curl/libcurl; it can leak HTTP authentication data when redirects occur. Root cause: libcurl may resend custom headers (e.g., Authorization) to hosts in a 30x redirect after sending to the initial URL. Connected advisories (e.g., CentOS/RHEL/CESA-2018:3157) confirm vulner...

PT-2018-17321

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 64.0.3282.119 Description The issue is related to insufficient data validation in DevTools, allowing a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension. This could enable...

PT-2018-17310

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 64.0.3282.119 Description The issue is related to insufficient policy enforcement in Blink, allowing a remote attacker to potentially leak user cross-origin data via a crafted HTML page. This could enable...

Fedora 27 : varnish (2017-72b50be8d4)

Security fix for CVE-2017-8807: This fixes a possible data leak in stevedore transient objects in varnishd. Upstream reports: 'It is not inconceiveable that an attack can provoke this situation on vulnerable varnishd instances, where the leaked memory contains confidential data and therefore we...

Meltdown vulnerability in CPU processor kernel (CNVD-2018-00304)

CPU hardware is a set of firmware that runs in the CPU Central Processing Unit to manage and control the CPU. A Meltdown vulnerability exists in the CPU processor kernel that "melts" the security boundaries implemented by the hardware, allowing low-privileged user-level applications to "cross the...

Meltdown Vulnerability in CPU Processor Cores

CPU hardware is a set of firmware that runs in the CPU Central Processing Unit to manage and control the CPU. A Meltdown vulnerability exists in the CPU processor kernel that "melts" the security boundaries implemented by the hardware, allowing low-privileged user-level applications to "cross the...

PT-2018-1444

Name of the Vulnerable Software and Affected Versions Intel SGX affected versions not specified Huawei VRP affected versions not specified Description The issue is related to the implementation of Intel Software Guard Extensions SGX technology and speculative execution in microprocessors. It may...

apr: Out-of-bounds array deref in apr_time_exp*() functions

An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak...

Important: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security update

An update is now available for Red Hat JBoss Core Services. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link...

apr: Out-of-bounds array deref in apr_time_exp*() functions

An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak...

Citrix Systems NetScaler Application Delivery Controller and NetScaler Gateway Information Disclosure Vulnerability

Citrix Systems NetScaler Application Delivery Controller ADC and NetScaler Gateway formerly Citrix Access Gateway Enterprise Edition are both products of Citrix Systems, Inc. NetScaler ADC is a service and application delivery solution Application Delivery Controller; NetScaler Gateway is a secur...

IBM WebSphere MQ Denial of Service Vulnerability

IBM WebSphere MQ is a messaging middleware product from IBM, USA. The product focuses on providing a reliable and proven messaging backbone for Service Oriented Architecture SOA. A denial of service vulnerability exists in IBM WebSphere MQ versions 7.5, 8.0, and 9.0. A local attacker could exploi...

CVE-2017-11463: Undefined Security Weakness

In Ivanti Service Desk formerly LANDESK Management Suite versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in...

CVE-2017-1000410

The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. B...

FreeBSD : FreeBSD -- Kernel data leak via ptrace(PT_LWPINFO) (34a3f9b5-dab3-11e7-b5af-a4badb2f4699)

Not all information in the struct ptracelwpinfo is relevant for the state of any thread, and the kernel does not fill the irrelevant bytes or short strings. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information of the kernel stack...

Virtuozzo 7 : apr / apr-devel (VZLSA-2017-3270)

An update for apr is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

PT-2017-14063

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 63.0.3239.84 Opera affected versions not specified Description The issue is related to an inappropriate implementation in Skia canvas composite operations, allowing a remote attacker to leak cross-origin data vi...

Important: apr

Issue Overview: An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak.CVE-2017-12613 Affected Packages: apr Issue Correction: Run yum update apr or yum update...

CentOS Update for apr CESA-2017:3270 centos6

Check the version of apr SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882807";...

EulerOS 2.0 SP2 : apr (EulerOS-SA-2017-1304)

According to the version of the apr packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of...