PT-2017-13401

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows version 11.1 Description The issue could expose highly sensitive information in the error log to a local user under unusual circumstances. Recommendations For IBM DB2 for Linux, UNIX and Windows version 11.1...

Microsoft Windows Subsystem for Linux Elevation of Privilege Vulnerability

Microsoft Windows 10 is a next-generation cross-platform operating system released by Microsoft for PCs and laptops, tablets, and cell phones.Subsystem for Linux is one of the Linux subsystems. An elevation of privilege vulnerability exists in Subsystem for Linux in Microsoft Windows 10 version...

CVE-2017-8627

CVE-2017-8627 concerns the Windows Subsystem for Linux (WSL) in Windows 10 version 1703, where DoS can be triggered by how WSL handles memory objects. The vulnerability is local and affects WSL components via memory-object handling, with CVSS v3 base score 4.7 (AV:L, AC:H, PR:L, UI:N, S:U, C:N, I...

CVE-2017-8622

The CVE-2017-8622 entry describes an elevation-of-privilege vulnerability in Windows Subsystem for Linux (WSL) on Windows 10 version 1703, caused by improper handling of NT pipes. A locally authenticated attacker could execute code with elevated privileges by exploiting this flaw. Public referenc...

Microsoft Patch Tuesday - August 2017

Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 48 new vulnerabilities with 25 of them rated critical, 21 rated important, and 2 rated moderate. These...

PT-2017-18446

Name of the Vulnerable Software and Affected Versions Windows Subsystem for Linux version 10 1703 Description The issue is related to the handling of objects in memory, which can lead to a denial of service. This means that attackers can potentially affect the system, causing it to become...

CVE-2017-8622: Undefined Security Weakness

Windows Subsystem for Linux in Windows 10 1703 allows an elevation of privilege vulnerability when it fails to properly handle handles NT pipes, aka "Windows Subsystem for Linux Elevation of Privilege Vulnerability"...

PT-2017-18442

Name of the Vulnerable Software and Affected Versions Windows Subsystem for Linux version 10 1703 Description The issue arises from the Windows Subsystem for Linux failing to properly handle handles to NT pipes, leading to an elevation of privilege. This allows attackers to affect the system...

CVE-2017-8627: Improper Restriction of Operations within the Bounds of a Memory Buffer

Windows Subsystem for Linux in Windows 10 1703, allows a denial of service vulnerability due to the way it handles objects in memory, aka "Windows Subsystem for Linux Denial of Service Vulnerability"...

KLA11087 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in...

KB4034674: Windows 10 Version 1703 August 2017 Cumulative Update

The remote Windows host is missing security update 4034674. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists when Microsoft Windows improperly handles NetBIOS packets. An attacker who successfully exploited this vulnerability could cause a target...

CVE-2017-9812: Exposure of Sensitive Information to an Unauthorized Actor

The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312 to read arbitrary files with kluser privileges...

CVE-2017-9813: Improper Neutralization of Input During Web Page Generation

In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312, the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting XSS...

CVE-2017-9810: Cross-Site Request Forgery (CSRF)

There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312. This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain...

CVE-2017-9811: Improper Input Validation

The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312. By abusing the quarantine read and write operations, it is possible to elevate the privileges to root...

PT-2017-12811

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows versions 9.2, 10.1, 10.5, and 11.1 Description The issue is caused by improper bounds checking, leading to a stack-based buffer overflow. This could allow a local attacker to execute arbitrary code...

Gstreamer 1.x Support on Receiver for Linux (Rfl)

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Receiver for Linux Rfl leveraged Gstreamer components to decode and play the data streams, which is ...

PT-2017-2229

Name of the Vulnerable Software and Affected Versions FortinetClient for Linux affected versions not specified Description The issue is related to insufficient access control in the SSL VPN software. It allows a remote attacker to execute arbitrary files with root privileges by replacing the...

CVE-2017-9037: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the 1 S44, 2 S5, 3 Sactionfail, 4 Sptnupdate, 5 T113, 6 T114, 7 T115, 8 T117117, 9 T118, 10 Tactionfail, 11 Tptnupdate, 12...

CVE-2017-9032: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the 1 T1 or 2 tmLastConfigFileModifiedDate parameter to logmanagement.cgi...