PT-2018-18557

Name of the Vulnerable Software and Affected Versions Microsoft Active Directory Federation Services AD FS affected versions not specified Description A cross-site-scripting XSS issue exists due to improper sanitization of specially crafted web requests to an affected AD FS server. This affects W...

CVE-2018-8326

CVE-2018-8326 concerns an XSS vulnerability in the Open Source Customization for Active Directory Federation Services (ADFS). The issue arises when the open source customization fails to sanitize a specially crafted web request sent to an affected AD FS server, allowing a remote attacker to execu...

CVE-2018-8326

A cross-site-scripting XSS vulnerability exists when an open source customization for Microsoft Active Directory Federation Services AD FS does not properly sanitize a specially crafted web request to an affected AD FS server, aka "Open Source Customization for Active Directory Federation Service...

kernel security and bug fix update

2.6.32-754.2.1.OL6 - Update genkey bug 25599697 2.6.32-754.2.1 - x86 entry/64: Don't use IST entry for BP stack Waiman Long 1596113 CVE-2018-10872 - fs gfs2: Flush delayed work earlier in gfs2inodelookup Andreas Grunbacher 1506281 - mm mempolicy: fix use after free when calling getmempolicy Augus...

CVE-2018-5873

The CVE-2018-5873 entry refers to a race-condition induced Use-After-Free in the Linux kernel before 4.11, specifically in __ns_get_path within fs/nsfs.c. This affects the mainline Linux kernel and Android builds derived from CAF for Android kernels (Android for MSM, Firefox OS for MSM, QRD Andro...

CVE-2018-5873

An issue was discovered in the nsgetpath function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condition when accessing files, a Use After Free condition can occur. This also affects all Android releases from CAF using the Linux kernel Android for MSM, Firefox OS for MSM, QRD Andro...

CVE-2018-13405

The inodeinitowner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigge...

CVE-2018-13405: Improper Privilege Management

The inodeinitowner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigge...

CVE-2018-5873: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in the nsgetpath function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condition when accessing files, a Use After Free condition can occur. This also affects all Android releases from CAF using the Linux kernel Android for MSM, Firefox OS for MSM, QRD Andro...

CVE-2018-13097

An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds read or a divide-by-zero error for an incorrect userblockcount in a corrupted f2fs image, leading to a denial of service BUG...

Design/Logic Flaw

An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3, which does not properly validate secsperzone in a corrupted f2fs image, as demonstrated by a divide-by-zero error...

CVE-2018-13097

An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds read or a divide-by-zero error for an incorrect userblockcount in a corrupted f2fs image, leading to a denial of service BUG...

CVE-2018-13098

An issue was discovered in fs/f2fs/inode.c in the Linux kernel through 4.17.3. A denial of service slab out-of-bounds read and BUG can occur for a modified f2fs filesystem image in which FIEXTRAATTR is set in an inode...

CVE-2018-13100

An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3, which does not properly validate secsperzone in a corrupted f2fs image, as demonstrated by a divide-by-zero error...

CVE-2018-13097

An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds read or a divide-by-zero error for an incorrect userblockcount in a corrupted f2fs image, leading to a denial of service BUG...

CVE-2018-13093

An issue was discovered in fs/xfs/xfsicache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference and panic in lookupslow on a NULL inode-iops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that cached inodes are free...

CVE-2018-13098

CVE-2018-13098 applies to the Linux kernel’s F2FS implementation, specifically fs/f2fs/inode.c up to version 4.17.3. The issue is a denial-of-service condition caused by a slab out-of-bounds read and a BUG when FI_EXTRA_ATTR is set in an inode of a modified F2FS image. Connected Nessus advisories...

CVE-2018-13095

CVE-2018-13095 affects the Linux kernel up to 4.17.3 in fs/xfs/libxfs/xfs_inode_buf.c. A corrupted XFS image with an inode in extent format that has more extents than fit in the inode fork can trigger memory corruption and a bug (DoS). The connected advisories (Unity Linux, various Nessus plugins...

CVE-2018-13099

CVE-2018-13099 concerns the Linux kernel fs/f2fs/inline.c up to version 4.4, where a denial of service can occur via an out-of-bounds memory access and BUG when a modified f2fs image contains an inline inode with an invalid reserved blkaddr. The connected Nessus advisories (Unity Linux) describe ...

CVE-2018-13099

An issue was discovered in fs/f2fs/inline.c in the Linux kernel through 4.4. A denial of service out-of-bounds memory access and BUG can occur for a modified f2fs filesystem image in which an inline inode contains an invalid reserved blkaddr...