OPENSUSE-SU-2019:1657-1 Security update for exempi

This update for exempi fixes the following issues: - CVE-2018-12648: Fixed a NULL pointer dereference crash issue when processing webp files bsc1098946. This update was imported from the SUSE:SLE-15:Update update project...

CVE-2019-11036

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exifprocessIFDTAG function. This may lead to information disclosure or crash...

The vulnerability of the ClamAV antivirus software lies in the fact that an operation is performed outside the buffer in memory, allowing a hacker to trigger a service failure.

The vulnerability of the ClamAV antivirus program is related to the issue of writing operations outside the buffer in memory when processing OLE2 files. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

com.qulice:qulice-ant (0.12.1), com.qulice:qulice-checkstyle (0.12.1) +1 more potentially affected by CVE-2019-9658 via com.puppycrawl.tools:checkstyle (5.9)

com.puppycrawl.tools:checkstyle MAVEN version 5.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.puppycrawl.tools:checkstyle and may be impacted: - com.qulice:qulice-ant 0.12.1 - com.qulice:qulice-checkstyle 0.12.1 - com.qulice:qulice-maven-plugin...

CVE-2018-19020

When CX-Supervisor Versions 3.42 and prior processes project files and tampers with the value of an offset, an attacker can force the application to read a value outside of an array...

CVE-2016-1000282

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection...

SUSE-SU-2018:4194-1 Security update for ovmf

This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-3613: Fixed AuthVariable Timestamp zeroing issue on APPENDWRITE bsc1115916. - CVE-2017-5731: Fixed privilege escalation via processing of malformed files in TianoCompress.c bsc1115917. - CVE-2017-5732: Fixed...

Cisco WebEx Recorder and Player asplayback Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Cisco WebEx Recorder and Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

[SECURITY] Fedora 29 Update: ruby-2.5.3-99.fc29

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

CVE-2018-17909

When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed memory, which may allow an attacker to execute code under the context of the application...

CVE-2018-17901

The CVE-2018-17901 entry concerns LAquis SCADA (versions 4.1.0.3870 and earlier). It describes a vulnerability in processing project files where input is not sanitized before write operations on a stack object, potentially allowing code to be executed in the context of the current process. Docume...

PT-2018-14175

Name of the Vulnerable Software and Affected Versions Foxit Reader version 9.2.0.9297 Description This issue allows remote attackers to disclose sensitive information on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file...

Cisco Issues New Warning for 6-Month-Old Critical Bug in IOS XE

UPDATE Cisco Systems has issued a second warning for a critical static credential bug in its IOS XE software, which allows an unauthenticated attacker to gain access to targeted systems. The security bulletin comes more than six months after the company initially reported the bug and provided a...

Artifex Ghostscript Information Disclosure Vulnerability (CNVD-2020-54498)

Artifex Ghostscript is an open source Postscript a page description language and programming language used in the electronics industry and desktop publishing parser from Artifex Software that displays Postscript files and prints them on non-Postscript printers. Postscript file. A security...

UBUNTU-CVE-2018-16335

newoffsets handling in ChopUpSingleUncompressedStrip in tifdirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a...

PT-2018-12435

Name of the Vulnerable Software and Affected Versions Foxit Reader version 9.1.0.5096 Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw...

CVE-2018-10921

CVE-2018-10921 affects the ttembed input file processing component. The connected documents describe an integer overflow triggered by processing crafted input files due to a lack of checking return codes from fgetc/fputc, potentially leading to input file corruption. Several sources (including Ne...

CVE-2017-2587

A memory allocation vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to crash...

The vulnerability of the DlgSelectMibFile.asp component of the WhatUp Gold network infrastructure monitoring system allows a hacker to execute arbitrary code.

The vulnerability of the DlgSelectMibFile.asp component of the WhatUp Gold network infrastructure monitoring system is related to errors in code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands or code using a specially crafted SNMP MIB file...

The software of Mitsubishi Electric’s E1000 E-Designer panel programming system is vulnerable due to buffer overflows in memory. This allows attackers to execute arbitrary code under the authority of the administrator or trigger a service failure.

The vulnerability of Mitsubishi Electric’s E1000 E-Designer panel programming software lies in buffer overflows that occur during the processing of configuration files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on behalf of the administrator or trigger a...