Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID:CVE-2021-38185 DESCRIPTION: GNU cpio could allow a remote attacker to execute arbitrary code on the system, caused by an integer...

Moderate: Red Hat Security Advisory: zlib security update

An update for zlib is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

AlmaLinux 8 : zlib (ALSA-2022:7106)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:7106 advisory. - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications tha...

Slackware Linux 15.0 / current samba Vulnerability (SSA:2022-298-02)

The version of samba installed on the remote host is prior to 4.15.11 / 4.17.2. It is, therefore, affected by a vulnerability as referenced in the SSA:2022-298-02 advisory. - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrapdes and unwrapdes3 routines of...

Moderate: zlib security update

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs. Security Fixes: zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field CVE-2022-37434 For more details about the...

SUSE-SU-2022:3691-1 Security update for bluez

This update for bluez fixes the following issues: - CVE-2019-8921: Fixed heap-based buffer overflow via crafted request bsc1193237. - CVE-2019-8922: Fixed heap-based buffer overflow via crafted request bsc1193227. - CVE-2020-26558: Fixed vulnerability that may permit a nearby man-in-the-middle...

Amazon Linux 2 : vim (ALAS-2022-1868)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1868 advisory. A flaw was found in vim, which is vulnerable to an out-of-bounds read in the msgouttransspecial function. This flaw allows a specially crafted file to crash software or execute code when opened i...

Amazon Linux AMI : vim (ALAS-2022-1639)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1639 advisory. A flaw was found in vim, which is vulnerable to an out-of-bounds read in the msgouttransspecial function. This flaw allows a specially crafted file to crash software or execute code when opened in...

Heap Buffer Overflow

libgpac.so is vulnerable to heap-based buffer overflow. The vulnerability exists in multiple functions of boxdump.c which allows an attacker to send crafted file in to the system causing an application crash...

SUSE-SU-2022:3598-1 Security update for exiv2

This update for exiv2 fixes the following issues: - CVE-2021-37621: Fixed denial of service due to infinite loop in Image:printIFDStructure bsc1189333. - CVE-2021-37620: Fixed out-of-bounds read in XmpTextValue:read bsc1189332. - CVE-2021-37619: Fixed out-of-bounds read in...

GLSA-202210-08 : Tcpreplay: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202210-08 Tcpreplay: Multiple Vulnerabilities - tcpreplay 4.3.4 has a Reachable Assertion in addtreeipv6 at tree.c CVE-2021-45386 - tcpreplay 4.3.4 has a Reachable Assertion in addtreeipv4 at tree.c. CVE-2021-45387 - Tcpreplay...

Ubuntu 20.04 LTS : gThumb vulnerabilities (USN-5680-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5680-1 advisory. It was discovered that gThumb did not properly managed memory when processing certain image files. If a user were tricked into opening a specially crafte...

CVE-2022-35711

Adobe ColdFusion versions Update 14 and earlier and Update 4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is...

CVE-2022-35712

Adobe ColdFusion versions Update 14 and earlier and Update 4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is...

Heap overflow

Adobe ColdFusion versions Update 14 and earlier and Update 4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is...

CVE-2022-35711 Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerability

Adobe ColdFusion versions Update 14 and earlier and Update 4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is...

CVE-2022-35712

CVE-2022-35712 is a heap-based buffer overflow affecting Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier). The vulnerability can lead to arbitrary code execution in the context of the current user and is triggered by a crafted network packet sent to the server, with no...

Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe ColdFusion. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of GIOP packets. The issue results from the lack of proper validation of...

AlmaLinux 8 : mariadb:10.3 (ALSA-2022:6443)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:6443 advisory. mariadb: MariaDB through 10.5.9 allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used CVE-2021-46669 mysql:...

Oracle Linux 8 : kvm_utils2 (ELSA-2022-9862)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9862 advisory. - A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated message...