SUSE-SU-2022:4443-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: release-notes-susemanager: - Mention bsc1205339 at the release notes...

Security Bulletin: Vulnerability in Newtonsoft.Json may affect IBM Spectrum Protect Snapshot for Windows

Summary IBM Spectrum Protect Snapshot for Windows may be affected by a denial of service vulnerability in Newtonsoft.Json Vulnerability Details IBM X-Force ID: 234366 DESCRIPTION: Newtonsoft.Json is vulnerable to a denial of service, caused by improper handling of StackOverFlow exception SOE...

GSD-2022-1007610 xen/gntdev: Prevent leaking grants

xen/gntdev: Prevent leaking grants This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.298 by commit 49bb053b1ec367b6883030eb2cca696e91435679,...

Wrong calculation in LBRouter._getAmountsIn.

Lines of code Vulnerability details Impact It calculates the amountsIn wrongly here and the function returns the wrong result. Proof of Concept Currently, getAmountsIn calculates the amountsIn like below. amountsIni - 1 = reserveIn amountOut 1000 / reserveOut - amountOut 997 + 1; As we can see...

_writeCheckpoint not working correctly if oldCheckpoint.fromBlock == block.number

Lines of code Vulnerability details Impact function writeCheckpoint uint256 toTokenId, uint256 nCheckpoints, uint256 memory delegatedTokenIds internal requiredelegatedTokenIds.length 0 && oldCheckpoint.fromBlock == block.number oldCheckpoint.delegatedTokenIds = delegatedTokenIds; else...

Synology Photo Station Session Fixation Vulnerability (CNVD-2022-67854)

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology Inc. of Taiwan, China. A session fixation vulnerability exists in Synology Photo Station, which can be exploited by attackers to bypass security constraints via unspecified vectors...

Security Bulletin: Information Disclosure and Denial of Service Vulnerabilities in IBM Spectrum Protect Backup-Archive Client (CVE-2022-22478, CVE-2022-22474)

Summary The IBM Spectrum Protect back-up archive client is vulnerable to information disclosure as user credentials are stored in memory in plain text. The back-up archive client is also vulnerable to a denial of service due to certain read operations on TCP/IP sockets. Vulnerability Details...

CVE-2014-125016

A vulnerability was found in FFmpeg 2.0. It has been rated as problematic. This issue affects the function ffinitbufferinfo of the file utils.c. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue...

Security Bulletin: IBM Spectrum Protect Plus may disclose sensitive information in virgo log file (CVE-2022-22396)

Summary IBM Spectrum Protect Plus may disclose credentials in clear text in the virgo log file. Vulnerability Details CVEID:CVE-2022-22396 DESCRIPTION: Credentials are printed in clear text in the IBM Spectrum Protect Plus virgo log file in certain cases. Credentials could be the remote vSnap,...

Security Bulletin: Information Disclosure in IBM Spectrum Protect Operations Center Browser's History (CVE-2022-22484)

Summary IBM Spectrum Protect Operations Center may disclose sensitive information in plain text in the brower's application command history. Vulnerability Details CVEID:CVE-2022-22484 DESCRIPTION: IBM Spectrum Protect Operations Center could allow a local attacker to obtain sensitive information,...

GSD-2022-1002308 drbd: Fix five use after free bugs in get_initial_state

drbd: Fix five use after free bugs in getinitialstate This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.238 by commit...

Security Bulletin: Vulnerabilities in IBM Db2 affect IBM Spectrum Protect Server (CVE-2021-38931, CVE-2021-29678, CVE-2021-20373, CVE-2021-39002, CVE-2021-38926)

Summary The IBM Spectrum Protect Server might be affected by vulnerabilities in IBM Db2 such as information disclosure, weaker than expected cryptographic algorithms, and elevated privileges. UPDATED: March 14, 2022 - The fixing level for these CVEs has been changed to 8.1.14.100. Vulnerability...

A week in security (March 7 – March 13)

Last week on Malwarebytes Labs: The struggle to reduce bug-fixing time is real Update now! Mozilla patches two actively exploited vulnerabilities Google takes on Docs notification spammers When fake dating profiles try the military approach Azure AutoWarp brings automation headaches RagnarLocker...

Security Bulletin: IBM Spectrum Protect Plus is vulnerable to PostgreSQL Man-in-the-Middle and Slowloris Denial of Service attacks (CVE-2021-23222, CVE-2022-22354)

Summary PostgreSQL is vulnerable to a man-in-the-middle attack which can affect IBM Spectrum Protect Plus. In addition, IBM Spectrum Protect Plus is vulnerable to a Slowloris denial of service attack. Vulnerability Details CVEID: CVE-2021-23222 DESCRIPTION: PostgreSQL is vulnerable to a...

The struggle to reduce bug-fixing time is real

There are many reasons why we want a bug fixed as soon as we can, but there are also plenty of reasons why doing it “right now” is not an option. This phenomenon starts at the side of the developers. The average time to fix a bug seems to vary depending on the platform the bug was found in. What ...

Security Bulletin: Vulnerabilities in Apache Log4j affect IBM Spectrum Protect Snapshot on Windows (CVE-2021-45105 and CVE-2021-45046)

Summary Vulnerabilities in Apache Log4j could result in a denial of service or remote code execution. IBM Spectrum Protect Snapshot on Windows includes the IBM Spectrum Protect Backup-Archive Cliient which installs the vulnerable Log4j files. Based on current information and analysis, Log4j is no...

Mageia: Security Advisory (MGASA-2016-0058)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for expat (important)

openSUSE Security Update: Security update for expat Announcement ID: openSUSE-SU-2022:0178-1 Rating: important References: 1194251 1194362 1194474 1194476 1194477 1194478 1194479 1194480 Cross-References: CVE-2021-45960 CVE-2021-46143 CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825...

Security Bulletin: Vulnerabilities in Apache Log4j impacts IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments (CVE-2021-45105, CVE-2021-45046)

Summary Vulnerabilities in Apache Log4j could result in a denial of service or remote code execution. These vulnerabilities may impact the IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments due to their uses of Apache Log4j for logging of messages and...

ROS-2-1161

2.1161 Notification on the update of the Red OS OPERATION SYSTEM MIS Due to quality improvement and bug fixing, an updated version of the "RED OS" Operating System "RED OS" 7.3 is released. You can contact the technical support service within the framework of your existing technical support...