OpenJDK: missing algorithm restrictions for jar verification (Libraries, 8155973)

It was discovered that the Libraries component of OpenJDK did not restrict the set of algorithms used for JAR integrity verification. This flaw could allow an attacker to modify content of the JAR file that used weak signing key or hash algorithm...

OpenJDK: incorrect handling of MethodHandles.dropArguments() argument (Libraries, 8155985)

Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610...

OpenJDK: missing ObjectIdentifier length check (Libraries, 8168705)

It was discovered that the Libraries component of OpenJDK did not validate the length of the object identifier read from the DER input before allocating memory to store the OID. An attacker able to make a Java application decode a specially crafted DER input could cause the application to consume...

OpenJDK: incorrect ECDSA signature extraction from the DER input (Libraries, 8168714)

It was discovered that the Libraries component of OpenJDK accepted ECDSA signatures using non-canonical DER encoding. This could cause a Java application to accept signature in an incorrect format not accepted by other cryptographic tools...

The installer of The Public Certification Service for Individuals "The JPKI user's software" may insecurely load Dynamic Link Libraries

Overview The installer of The Public Certification Service for Individuals "The JPKI user's software" provided by Japan Agency for Local Authority Information Systems J-LIS contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Note that this...

Microsoft Windows COM Elevation of Privilege (CVE-2017-0214)

An elevation of privilege vulnerability exists in Microsoft Windows. The vulnerability is due to an error in the way Windows validate input before loading type libraries. A remote attacker can exploit this vulnerability to execute arbitrary code...

PT-2017-10461 · Microsoft · Windows Server 2012 +7

Name of the Vulnerable Software and Affected Versions: Windows versions prior to the fixed version Description: The issue arises when Windows fails to properly validate input before loading type libraries, allowing an elevation of privilege. This could potentially affect the system...

rpcbind, LIBTIRPC and NTIRPC Denial of Service Vulnerabilities

rpcbind, LIBTIRPC, and NTIRPC are all applications used in Linux. rpcbind is a server that translates RPC program numbers into generic addresses; LIBTIRPC is a package that contains libraries to support programs that use the Remote Procedure Call RPC API; and NTIRPC is a stand-alone RPC library f...

EulerOS 2.0 SP1 : java-1.7.0-openjdk (EulerOS-SA-2016-1032)

According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple flaws were discovered in the Hotspot and Libraries components in OpenJDK. An untrusted Java application or applet could use...

CVE-2017-3551

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Smartcard Libraries. The supported version that is affected is 11.3. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise...

Code injection

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Smartcard Libraries. The supported version that is affected is 11.3. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise...

CVE-2017-3551

CVE-2017-3551 affects Oracle Solaris 11.3 Smartcard Libraries. It is a local, low-privilege condition that can lead to Solaris hang/crash (DOS) and unauthorized read/update/delete of data. CVSSv3 base score 6.6 (AV:L, AC:L, PR:L, UI:N, C:L/I:L/A:H). Remediation is referenced in the APR2017 CPU ad...

CVE-2017-3551

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Smartcard Libraries. The supported version that is affected is 11.3. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise...

CVE-2017-3551

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Smartcard Libraries. The supported version that is affected is 11.3. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise...

OpenJDK: untrusted extension directories search path in Launcher (JCE, 8163528)

An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges...

CentOS Update for nss-util CESA-2017:1100 centos7

Check the version of nss-util SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882702";...

CentOS Update for nss CESA-2017:1100 centos6

Check the version of nss SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882701";...

OpenJDK: untrusted extension directories search path in Launcher (JCE, 8163528)

An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges...

digital.libraries.uc.edu XSS vulnerability

Vulnerable URL: http://digital.libraries.uc.edu/collections/lewisandclark/exhibits/botany/salal.php?imageres=%27%22%3E%3Cimg%20src=x%20onerror=alert/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status...

Critical: Red Hat Security Advisory: nss-util security update

An update for nss-util is now available for Red Hat Enterprise Linux 6.2 Advanced Update Support, Red Hat Enterprise Linux 6.4 Advanced Update Support, Red Hat Enterprise Linux 6.5 Advanced Update Support, Red Hat Enterprise Linux 6.5 Telco Extended Update Support, Red Hat Enterprise Linux 6.6...