February 12, 2019—KB4487695 Update for Windows 10 Mobile (OS Build 15254.552)

February 12, 2019—KB4487695 Update for Windows 10 Mobile OS Build 15254.552 Improvements and fixes This update includes quality improvements. No new operating system features are being introduced in this update. Key changes include: This build includes all the improvements from KB4487020. If you...

Ubuntu 16.04 LTS / 18.04 LTS : MySQL vulnerabilities (USN-3867-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3867-1 advisory. Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. Ubuntu 16.04 LTS...

USN-3867-1: MySQL vulnerabilities

Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10 have been updated to MySQL 5.7.25. In addition to security fixes, the updated packages contain bug fixes, new features,...

Qualys Cloud Platform (VM, PC) 8.16 New Features

This new release of the Qualys Cloud Platform VM, PC, version 8.16, contains several new improvements in Qualys Vulnerability Management and Qualys Policy Compliance, which includes new password security option, increased limit for virtual hosts that can be added to a subscription, added support...

GHSA-92WJ-X78C-M4FX XML External Entity Reference in Apache Karaf

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

XML External Entity Reference in Apache Karaf

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

Design/Logic Flaw

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

CVE-2018-11788

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

CVE-2018-11788

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

CVE-2018-11788

Apache Karaf contains an XXE vulnerability in its XMLInputFactory used by the features deployer. The XMLInputFactory does not implement mitigation against external entities, enabling potential XML External Entity Injection in Karaf versions prior to 4.1.7 and prior to 4.2.2. First fixed in Karaf ...

CVE-2018-11788

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

January 8, 2019—KB4483203 Update for Windows 10 Mobile (OS Build 15254.547)

January 8, 2019—KB4483203 Update for Windows 10 Mobile OS Build 15254.547 Improvements and fixes This update includes quality improvements. No new operating system features are being introduced in this update. Key changes include: This build includes all the improvements from KB4480973. If you...

Fedora 28 : libvirt (2018-527698a904) (Spectre)

Add new CPU features for speculative store bypass CVE-2018-3639 On Intel x86 hosts, the 'ssbd' feature must be explicitly added to any virtual machines that are not using host-passthrough/host-model CPU setup. NB this requires new microcode too, which is not yet available in Fedora microcodectl...

Fedora 28 : mkvtoolnix (2018-317ecbb54f)

Version 28.2.0 'The Awakening' 2018-10-25 Bug fixes - mkvmerge, mkvinfo, mkvextract, mkvpropedit, MKVToolNix GUI's info tool & chapter editor: fixed a case of memory being accessed after it had been freed earlier. This can be triggered by specially crafted Matroska files and lead to arbitrary cod...

Fedora 29 : mongo-c-driver (2018-2f8f5f75f1)

libbson 1.13.0 Features: - New functions to save and restore progress of a bsonitert: bsoniterkeylen, bsoniteroffset, and soniterinitfromdataatoffset Additional functions bsoniteroverwritedatetime, bsoniteroverwriteoid, and bsoniteroverwritetimestamp. All fixed-length BSON values can now be updat...

Fedora 28 : kernel / kernel-tools (2018-2c6bd93875)

The 4.17.2 kernel rebase contains new drivers, new features, and a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it...

SUSE SLES12 Security Update : slurm (SUSE-SU-2017:3311-1)

This update for slurm fixes the following issues: Slurm was updated to 17.02.9 to fix a security bug, bringing new features and bugfixes fate323998 bsc1067580. Security issue fixed : - CVE-2017-15566: Fix security issue in Prolog and Epilog by always prepending SPANK to all user-set environment...

[SECURITY] Fedora 28 Update: phpMyAdmin-4.8.4-1.fc28

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

New Delegated Administration feature in Enterprise Threat Protector

Managing security configurations for large organizations with locations scattered around the world can be challenging. Likewise, some businesses have multiple operating divisions that are separate entities but all use the same IT infrastructure. As an IT leader, you likely want to have consistenc...

Multiple vulnerabilities in Toshiba Lighting & Technology Corporation Home gateway

Overview Home gateway provided by Toshiba Lighting & Technology Corporation contains multiple vulnerabilities listed below. Improper access control CWE-284 - CVE-2018-16197 Hidden functionality CWE-912 - CVE-2018-16198 Cross-site scripting CWE-79 - CVE-2018-16199 OS command injection CWE-78 -...