PT-2018-3454 · Exiv2 +8 · Exiv2 +8

Name of the Vulnerable Software and Affected Versions: Exiv2 version 0.26 Description: The issue is related to excessive stack consumption due to a recursive function in the CiffDirectory::readDirectory at crwimage int.cpp, leading to a denial of service. This can be exploited by a remote attacke...

Security update for GraphicsMagick (important)

This update for GraphicsMagick fixes the following issues: Security issue fixed: - Disable PS, PS2, PS3 and PDF coders by default, remove gs calls from delegates.mgk boo1105592...

SUSE-SU-2018:2778-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: The following security vulnerabilities were fixed: - CVE-2018-16329: Prevent NULL pointer dereference in the GetMagickProperty function leading to DoS bsc1106858 - CVE-2018-16323: ReadXBMImage left data uninitialized when processing an XBM...

Adobe Flash Player End of Life (EOL) Detection - Mac OS X

The Adobe Flash Player on the remote host has reached the end of life EOL / is discontinued and should not be used anymore. This VT has been deprecated and replaced by the VT SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

PT-2018-16335 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit Software's PDF Reader version 9.1.0.5096 Description: A use-after-free issue in the JavaScript engine allows for arbitrary code execution when a specially crafted PDF document is opened, causing a previously freed object in memory to be...

PT-2018-13960 · Videolan · Libmp4V2

Name of the Vulnerable Software and Affected Versions: libmp4v2 version 2.1.0 Description: The issue arises from the function mp4v2::impl::MP4Track::FinishSdtp in mp4track.cpp, which mishandles compatibleBrand while processing a crafted mp4 file. This leads to a heap-based buffer over-read,...

PT-2018-13961 · Videolan · Libmp4V2

Name of the Vulnerable Software and Affected Versions: libmp4v2 version 2.1.0 Description: The issue arises from the function MP4Free in mp4property.cpp, which internally calls free on an invalid pointer. This results in a SIGABRT signal being raised. Recommendations: For libmp4v2 version 2.1.0,...

CVE-2018-16225

The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android, which results in an attacker being able to reuse cookies to bypass authentication and...

Authentication flaw

The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android, which results in an attacker being able to reuse cookies to bypass authentication and...

CVE-2018-16225

The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android, which results in an attacker being able to reuse cookies to bypass authentication and...

JDK: privilege escalation via insufficiently restricted access to Attach API

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on...

JDK: privilege escalation via insufficiently restricted access to Attach API

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on...

HPESBHF03866 rev.3 - HPE Integrated Lights-Out 3,4,5 iLO Moonshot and Moonshot iLO Chassis Manager, using SSH, Remote Execution of Arbitrary Code, Local Disclosure of Sensitive Information

Potential Security Impact: Local: Disclosure of Sensitive Information; Remote: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers - Prior to v1.35 HPE Integrated Lights-Out 4 iLO 4 - Prior to v2.61 HPE...

Intel® Centrino® Wireless-N and Intel® Centrino® Advanced-N products Bluetooth Driver Advisory

Summary: A potential security vulnerability in ibtfltcoex.sys driver for Intel® Centrino® Wireless adapters may allow denial of service. Vulnerability Details: CVEID: CVE-2018-3669 Description: A STOP error BSoD in the ibtfltcoex.sys driver for Intel® Centrino® Wireless N and Intel® Centrino®...

UBUNTU-CVE-2016-7067

Monit before version 5.20.0 is vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitoring for a particular host or disable/enable monitoring for a specific service...

CVE-2016-7067

Monit before version 5.20.0 is vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitoring for a particular host or disable/enable monitoring for a specific service...

CVE-2016-7067

Monit before version 5.20.0 is vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitoring for a particular host or disable/enable monitoring for a specific service...

PT-2018-3607 · Poppler +4 · Poppler +4

Name of the Vulnerable Software and Affected Versions: Poppler version 0.68.0 Description: The issue is related to the Parser::getObj function in the Poppler library for rendering PDF files, which can cause infinite recursion when processing a crafted file. This can be exploited by a remote...

openSUSE Security Update : ImageMagick (openSUSE-2018-954)

This update for ImageMagick fixes the following issues : Security issue fixed : - Disable PS, PS2, PS3, XPS and PDF coders in default policy.xml bsc1105592 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive tex...

PT-2018-3976 · Xpdf +2 · Xpdf +2

Name of the Vulnerable Software and Affected Versions: Xpdf version 4.00 Description: The issue is related to errors in the code of the Xpdf software, specifically in the XRef::fetch function in XRef.cc. It allows remote attackers to cause a denial of service, which is a stack consumption, via a...