GStreamer security, bug fix, and enhancement update

clutter-gst2 2.0.18-1 - Update to 2.0.18 - Remove obsolete patches - Use license macro for COPYING - Resolves: 1386833 gnome-video-effects 0.4.3-1 - Update to 0.4.3 - Resolves: 1386968 0.4.1-5 - Fix URL rhbz1380981 gstreamer-plugins-bad-free 0.10.23-23 - Rebuild with hardened flags Resolves:...

PT-2019-5314

Name of the Vulnerable Software and Affected Versions Log4j versions 1.2 up to 1.2.17 Description The issue is related to the deserialization of untrusted data in the SocketServer class of Log4j 1.2, which can be exploited to remotely execute arbitrary code when combined with a deserialization...

CVE-2017-10677

Cross-Site Request Forgery CSRF exists on Linksys EA4500 devices with Firmware Version before 2.1.41.164606, as demonstrated by a request to apply.cgi to disable SIP...

MGASA-2017-0244 Updated evince packages fix security vulnerability

Felix Wilhelm discovered that Evince did not safely invoke tar when handling tar comic book cbt files. An attacker could use this to construct a malicious cbt comic book format file that, when opened in Evince, executes arbitrary code. Please note that this update disables support for cbt files i...

PT-2017-19223 · Sma Solar Technology · Sunny Tripower +3

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products affected versions not specified Sunny Boy versions TLST-21 and TL-21 Sunny Tripower versions TL-10 and TL-30 Description: The SMAdata2+ communication protocol in SMA Solar Technology products does not properly us...

Ford, BMW, Infiniti and Nissan TCU presence of a vulnerability, can be remote intrusion-vulnerability warning-the black bar safety net

! Three researchers found that Ford, BMW, Infiniti and Nissan Automatic Transmission Control UnitTCUin the presence of a vulnerability, these TCU are made by Continental AG production. Vulnerability causes The three researchers from McAfee, respectively, is Mickey Shkatov, Jesse, Michael and...

Denial of service

Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service. Formerly ZDI-CAN-4350...

PT-2018-8402 · Red Hat +2 · Pki-Core +3

Name of the Vulnerable Software and Affected Versions: pki-core versions prior to 10.6.4 Description: A flaw was discovered in the pki-core package where a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default. This could allow an attacker to bypass the regula...

Adobe to Completely Disable Flash Player by 2020

By Uzair Amir Adobe Flash has been in the news for all the wrong reasons lately, and it won’t be an overstatement that Flash Player is software that we love to hate. It has been receiving backlash from internet users for being resource sensitive and incompatible with smartphones apart from being...

Green Packet Routers OS Command Injection Vulnerability

Green Packet Routers are prone to an arbitrary OS command injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Hardentools - Utility that disables a number of risky Windows features

Hardentools is a collection of simple utilities designed to disable a number of "features" exposed by operating systems Microsoft Windows, for now, and primary consumer applications. These features, commonly thought for Enterprise customers, are generally useless to regular users and rather pose ...

Vulnerability in the PAN-OS DNS Proxy

A Remote Code Execution vulnerability exists in the PAN-OS DNS Proxy. This issue affects customers who have DNS Proxy enabled in PAN-OS. This issue affects both the Data and Management planes of the firewall. When DNS Proxy processes a specially crafted fully qualified domain names FQDN, it is...

CVE-2017-4918: VMware Horizon macOS client code injection vulnerability analysis-vulnerability warning-the black bar safety net

This article I want to discuss under the VMware Horizon macOS client version 4. 4. 0, the 5164329 of a code injection vulnerability, which can be used to obtain local root privileges. The good news is this issue already in the latest version is fix. 0x01 analysis On my MAC the above understanding...

AdBlock Filter Injection Vulnerability

AdBlock is an open source ad blocking plugin dedicated to GoogleChrome. A security vulnerability exists in versions of AdBlock prior to 2.21. A remote attacker can exploit the vulnerability to block arbitrary resources on any website and disable arbitrary blocking filters...

PT-2017-19247 · Microsoft +1 · Ntdll +2

Name of the Vulnerable Software and Affected Versions: IrfanView version 4.44 32bit with FPX Plugin 4.46 Description: The issue allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file. This is related to "Data from Faulting Address controls...

PT-2017-11505 · Mysql Server +3 · Dbd::Mysql +3

Name of the Vulnerable Software and Affected Versions: DBD::mysql versions through 4.043 Description: The issue allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack. This occurs because the mysql ssl=1 setting is used to mean that SSL is optional, despite the...

Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) -

Exploit for linux platform in category local exploits / Linuxldsohwcap64.c for CVE-2017-1000366, CVE-2017-1000379 Copyright C 2017 Qualys, Inc. myimportanthwcaps adapted from elf/dl-hwcaps.c, part of the GNU C Library: Copyright C 2012-2017 Free Software Foundation, Inc. This program is free...

PT-2017-3905 · Faad2 +1 · Faad2 +1

Name of the Vulnerable Software and Affected Versions: FAAD2 version 2.7 Description: The issue is related to the mp4ff parse tag function, which can lead to a denial of service due to an infinite loop and CPU consumption when processing a crafted mp4 file. This allows remote attackers to exploit...

PT-2017-3906 · Faad2 Team +1 · Faad2 +1

Name of the Vulnerable Software and Affected Versions: FAAD2 version 2.7 Description: The issue is related to the mp4ff read stsd function, which can be exploited by remote attackers to cause a denial of service. This is achieved through a crafted mp4 file, leading to a large loop and significant...

PT-2017-3908 · Freeware +1 · Faad2 +1

Name of the Vulnerable Software and Affected Versions: Freeware Advanced Audio Decoder 2 FAAD2 version 2.7 Description: The issue is related to the mp4ff read stco function, which can lead to a denial of service due to excessive CPU consumption caused by a large loop. This can be triggered by a...