CVE-2019-5668

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiSubmitCommandVirtual in which the application dereferences a pointer that it expects to be valid, but is NULL, which may lead to denial of service or escalation of privileges...

CVE-2019-5670

CVE-2019-5670 affects NVIDIA GeForce Windows GPU Display Driver. A flaw in the kernel-mode DxgkDdiEscape handler uses an incorrect length when reading/writing a buffer, causing out-of-bounds access and potential local escalation of privileges, code execution, denial of service, or information dis...

CVE-2019-5667

Summary of CVE-2019-5667 : NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel-mode layer (nvlddmkm.sys) handler for DxgkDdiSetRootPageTable, where a pointer expected to be valid is NULL, potentially enabling code execution, denial of service, or privilege escalation. Affecte...

CVE-2019-5668

CVE-2019-5668 refers to a vulnerability in the NVIDIA Windows GPU Display Driver’s kernel mode layer (nvlddmkm.sys), specifically the DxgkDdiSubmitCommandVirtual handler where a NULL pointer is dereferenced. The description and connected sources confirm the impact as denial of service or privileg...

CVE-2019-5666

CVE-2019-5666 affects the NVIDIA GPU Display Driver (kernel mode nvlddmkm.sys) for Windows and Linux. The issue arises in the DxgkDdiCreateContext path, where untrusted input is used to calculate or reference an array index without proper validation, enabling potential denial of service or privil...

CVE-2019-5665

CVE-2019-5665 affects NVIDIA GPU Display Drivers (Windows and Linux) in the 3D vision component. The root cause is the stereo service failing to validate hard links when opening a file, potentially enabling code execution, denial of service, or privilege escalation. Affected products include NVID...

SUSE SLES12 Security Update : qemu (SUSE-SU-2019:0489-1)

This update for qemu fixes the following issues : Security issues fixed : CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation bsc1123156. CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp bsc1119493. CVE-2018-19489:...

PHP Code Injection

smarty-php/smarty is vulnerable to PHP code injection attacks. The vulnerability exists as the template names are unsanitized when called from fetch or display, allowing PHP code injection attacks...

MeteoTemplate 17.1 Nectarine stationExtremes 2.0 Open Redirection

Exploit Title : MeteoTemplate 17.1 Nectarine stationExtremes Plugins 2.0 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 26/02/2019 Vendor Homepage : meteotemplate.com Software Download Link :...

[SECURITY] Fedora 28 Update: spice-0.14.0-5.fc28

The Simple Protocol for Independent Computing Environments SPICE is a remote display system built for virtual environments which allows you to view a computing 'desktop' environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine...

Security Bulletin: NVIDIA GPU Display Driver - February 2019

NVIDIA has released a software security update for the NVIDIA GPU Display Driver. This update addresses issues that may lead to denial of service, escalation of privileges, code execution, or information disclosure. To protect your system, download and install this software update through NVIDIA...

The vulnerability of the Message Display component of the Oracle Email Center messaging software in the Oracle E-Business Suite system, which is used for automating business operations. This vulnerability allows a malicious individual to modify protected data.

The vulnerability of the Message Display component of the Oracle Email Center messaging software in the Oracle E-Business Suite system, a business automation solution, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

The vulnerability of the Message Display component of the Oracle Email Center messaging software in the Oracle E-Business Suite system, which is used for automating business operations. This vulnerability allows a malicious individual to modify protected data.

The vulnerability of the Message Display component of the Oracle Email Center messaging software in the Oracle E-Business Suite system, a business automation solution, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

USN-3892-1: GDM vulnerability

Burghard Britzke discovered that GDM incorrectly handled certain configurations. An attacker could possibly use this issue to get unauthorized access to a different user...

USN-3892-1 gdm3 vulnerability

Burghard Britzke discovered that GDM incorrectly handled certain configurations. An attacker could possibly use this issue to get unauthorized access to a different user...

DEBIAN-CVE-2019-3812

QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2cddc function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host...

The vulnerability of the Message Display component of the Oracle Email Center messaging software in the Oracle E-Business Suite system allows a perpetrator to alter the access rights to files.

The vulnerability of the Message Display component of the Oracle Email Center messaging software in the Oracle E-Business Suite system is related to insufficient access control. Exploiting this vulnerability could allow an attacker, operating remotely, to alter the access rights to files using th...

DEBIAN-CVE-2018-20781

In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext...

UBUNTU-CVE-2018-20781

In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext...

A week in security (February 4 – 8)

Last week on Malwarebytes Labs, we took a closer look at the technical and reputational challenges for Facebook as it tries to integrate secure messaging across Messenger, WhatsApp, and Instagram. We explored Google’s latest attempts to change how the public sees—literally—web browser URLs, gave...