kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2018:2164 An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2018-14054

Removed by vendor...

CVE-2018-14054: LibMP4v2 MP4StringProperty Handling Double Free Vulnerability

LibMP4v2 is an open source MP4 processing library, designed to create and modify MP4 files as defined by ISO-IEC:14496-1:2001 MPEG-4 Systems. Originally discovered by Ruikai Liu, a double free vulnerability was found in the MP4StringProperty code. While parsing MP4 atoms, it is possible to cause ...

Huawei LYO-L21 Cell Phone Elevation of Privilege Vulnerability

The Huawei LYO-L21 is a smartphone product of the Chinese company Huawei. An elevation of privilege vulnerability exists in the Huawei LYO-L21 phone. After tricking a user into installing a malicious mobile application, an authenticated, local attacker constructs malformed messages and exploits t...

CVE-2018-10872

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch...

CVE-2018-10872

The CVE-2018-10872 issue is a Linux kernel vulnerability describing that exceptions after a stack switch via Mov SS or Pop SS are delivered only after the first instruction post-switch. An unprivileged user could trigger a DoS by crashing the kernel. The description notes this is a regression of ...

CVE-2018-10872

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch...

CVE-2018-10872

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch...

kernel: error in exception handling leads to DoS (CVE-2018-8897 regression)

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2018-10872

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch...

Denial Of Service (DoS)

libexiv2.so is vulnerable to denial of service DoS attacks. A malicious user can pass a tiff file to the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp to cause an exception that can crash the application...

Denial Of Service (DoS)

ASP.NET Core is vulnerable to a denial of service vulnerability. This is due to the way HTML Encoder processes unicode characters when performing encoding, which results in an exception...

Multiple Huawei Products Cross-Border Read Vulnerability

Huawei DP300 and others are products of Huawei, China.DP300 is a video conferencing terminal.RP200 is an all-in-one video conferencing device. An out-of-bounds read vulnerability exists in several Huawei products, where the program fails to adequately perform input validation of values in message...

CVE-2018-8036

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted or fuzzed file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser...

CVE-2018-8039

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty"java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol";'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old...

Design/Logic Flaw

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty"java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol";'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old...

Denial Of Service (DoS)

Apache PDFBox is vulnerable to denial of service DoS attacks. A malicious user can pass an AFM file to the application to cause an out-of-memory exception that can crash the application...

Debian DSA-4236-1 : xen - security update

Multiple vulnerabilities have been discovered in the Xen hypervisor : - CVE-2018-12891 It was discovered that insufficient validation of PV MMU operations may result in denial of service. - CVE-2018-12892 It was discovered that libxl fails to honour the 'readonly' flag on HVM-emulated SCSI disks....

[SECURITY] [DSA 4236-1] xen security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4236-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 27, 2018 https://www.debian.org/security/faq -...