ALBA-2019:3471 container-exception-logger bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

WebKit - Universal XSS in JSObject::putInlineSlow and JSValue::putToPrimitive

VULNERABILITY DETAILS bool JSObject::putInlineSlowExecState exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot ASSERT!isThisValueAlteredslot, this; VM& vm = exec-vm; auto scope = DECLARETHROWSCOPEvm; JSObject obj = this; for ;; unsigned attributes; PropertyOffset offset =...

The vulnerability of the JAXP component in Oracle Java SE and Oracle Java SE Embedded software platforms allows a hacker to cause partial service failure.

The vulnerability of the JAXP component in Oracle Java SE and Oracle Java SE Embedded software platforms is related to an exception handling error. Exploiting this vulnerability can allow a malicious actor to cause partial service disruption remotely...

The vulnerability of the Scripting component in Oracle Java SE and Java SE Embedded software platforms allows attackers to compromise the integrity of protected information or cause partial service interruptions.

The vulnerability of the Scripting component in Oracle Java SE and Java SE Embedded software-related programs is related to an exception handling error. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information or cause partial service...

The vulnerability of the Concurrency component in Oracle Java SE and Oracle Java SE Embedded software platforms allows a hacker to cause partial service disruption.

The vulnerability of the Concurrency component in Oracle Java SE and Oracle Java SE Embedded software lies in an exception handling error. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause partial service interruption...

The vulnerability of the Serialization component in Oracle Java SE and Oracle Java SE Embedded software platforms allows a attacker to cause partial service disruption.

The vulnerability of the Serialization component in Oracle Java SE and Oracle Java SE Embedded software platforms is related to an exception handling error. Exploiting this vulnerability can allow a malicious actor to cause partial service interruption remotely...

The vulnerability of the JAXP component in Oracle Java SE and Oracle Java SE Embedded software platforms allows a hacker to cause partial service failure.

The vulnerability of the JAXP component in Oracle Java SE and Oracle Java SE Embedded software is related to an exception handling error. Exploiting this vulnerability can allow a malicious actor to cause partial service interruption remotely...

CVE-2019-18422

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled...

DEBIAN-CVE-2019-18422

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled...

ALPINE-CVE-2019-18422

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled...

Design/Logic Flaw

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled...

CVE-2019-18422

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled...

ARM: Interrupts are unconditionally unmasked in exception handlers

ISSUE DESCRIPTION When an exception occurs on an ARM system which is handled without changing processor level, some interrupts are unconditionally enabled during exception entry. So exceptions which occur when interrupts are masked will effectively unmask the interrupts. IMPACT A malicious guest...

UBUNTU-CVE-2019-18422

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled...

Vulnerability of systems for data collection and process control in Schneider Electric’s industrial automation systems such as StruxureWare SCADA Expert, Vijeo Citect, CitectSCADA, StruxureWare PowerSCADA Expert, and PowerLogic SCADA. This vulnerability stems from improper handling of exceptions, allowing attackers to trigger service failures.

The vulnerabilities of systems for data collection and process control in Schneider Electric’s StruxureWare SCADA Expert, Vijeo Citect, Vijeo Citect, CitectSCADA, StruxureWare PowerSCADA Expert, and PowerLogic SCADA systems are related to improper handling of exceptions. Exploiting these...

Vulnerability of the ntdll function! The RtlRaiseStatus function in the WebAccess HMI Designer software development and management tool allows a hacker to cause a service failure.

The vulnerability of the ntdll!RtlRaiseStatus0x00000000000000b function in the WebAccess HMI Designer software for developing and managing HMI applications is related to deficiencies in handling exceptional states. Exploiting this vulnerability could allow an attacker to cause service failures...

Memory leak vulnerability in multiple Huawei products (CNVD-2019-38501)

The Huawei AR1200, among others, is an enterprise router from Huawei, a Chinese company. A memory leak vulnerability exists in multiple Huawei products. A remote attacker could exploit the vulnerability by sending a persistent message to cause a service exception...

SUSE SLED12 / SLES12 Security Update : libcaca (SUSE-SU-2019:2745-1)

This update for libcaca fixes the following issues : Security issues fixed : CVE-2018-20544: Fixed a floating point exception at caca/dither.c bsc1120502 CVE-2018-20545: Fixed a WRITE memory access in the loadimage function at common-image.c for 4bpp bsc1120584 CVE-2018-20546: Fixed a READ memory...

SUSE-SU-2019:2745-1 Security update for libcaca

This update for libcaca fixes the following issues: Security issues fixed: - CVE-2018-20544: Fixed a floating point exception at caca/dither.c bsc1120502 - CVE-2018-20545: Fixed a WRITE memory access in the loadimage function at common-image.c for 4bpp bsc1120584 - CVE-2018-20546: Fixed a READ...

python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py

Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...