openSUSE Security Update : qemu (openSUSE-2017-822)

This update for qemu fixes several issues. These security issues were fixed : - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service infinite loop by leveraging an incorrect return value bsc1042159. - CVE-2017-8379: Memory leak in the keyboard input...

CVE-2016-6312

CVE-2016-6312 is a regression of CVE-2009-1955 describing a DoS in Apache httpd/mod_dav_svn caused by the mod_dontdothat component failing to detect recursive XML entity expansion. Connected sources confirm the underlying issue is in APR-util's XML entity handling (as part of APR-util) used by Ap...

Security update for xen (important)

This update for xen fixes several issues. These security issues were fixed: - CVE-2017-10912: Page transfer might have allowed PV guest to elevate privilege XSA-217, bsc1042882 - CVE-2017-10913 CVE-2017-10914: Races in the grant table unmap code allowed for informations leaks and potentially...

CVE-2017-10914

The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service memory consumption, or possibly obtain sensitive information or gain privileges, aka XSA-218 bug 2...

USN-3350-1: poppler vulnerabilities

Aleksandar Nikolic discovered that poppler incorrectly handled JPEG 2000 images. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. CVE-2017-28...

Race condition

The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service memory consumption, or possibly obtain sensitive information or gain privileges, aka XSA-218 bug 2...

CVE-2017-10914

The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service memory consumption, or possibly obtain sensitive information or gain privileges, aka XSA-218 bug 2...

CVE-2017-10914

The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service memory consumption, or possibly obtain sensitive information or gain privileges, aka XSA-218 bug 2...

CVE-2017-10914

The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service memory consumption, or possibly obtain sensitive information or gain privileges, aka XSA-218 bug 2...

CVE-2017-10914

The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service memory consumption, or possibly obtain sensitive information or gain privileges, aka XSA-218 bug 2...

CVE-2017-10914

CVE-2017-10914 affects Xen (grant-table feature) through 4.8.x due to a race condition in grant handling that can cause a double free. Impact includes denial of service (memory consumption) and potential information disclosure or privilege escalation. Based on the sources, exploitability depends ...

CVE-2017-1254: Improper Restriction of XML External Entity Reference

IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 124634...

Memory corruption

Memory leak in the virtiogpuobjectcreate function in drivers/gpu/drm/virtio/virtgpuobject.c in the Linux kernel through 4.11.8 allows attackers to cause a denial of service memory consumption by triggering object-initialization failures...

CVE-2017-10810

Memory leak in the virtiogpuobjectcreate function in drivers/gpu/drm/virtio/virtgpuobject.c in the Linux kernel through 4.11.8 allows attackers to cause a denial of service memory consumption by triggering object-initialization failures...

Denial Of Service (DoS) Through Memory Consumption

The nokogiri gem is using libxml2 which is vulnerable to a denial of service DoS vulnerability. It is possible because the xmlSkipBlankChars method does not properly handle the blank characters from the XML input streams, leading to a recursive loop and high memory consumption. This can cause the...

SUSE SLES11 Security Update : xen (SUSE-SU-2017:1715-1)

This update for xen fixes the following security issues : - blkif responses leaked backend stack data, which allowed unprivileged guest to obtain sensitive information from the host or other guests XSA-216, bsc1042863 - Page transfer might have allowed PV guest to elevate privilege XSA-217,...

SMBLoris NBSS Denial of Service

The SMBLoris attack consumes large chunks of memory in the target by sending SMB requests with the NetBios Session ServiceNBSS Length Header value set to the maximum possible value. By keeping these connections open and initiating large numbers of these sessions, the memory does not get freed, an...

PT-2017-2595

Name of the Vulnerable Software and Affected Versions ImageMagick versions 7.0.6-1 Description The issue is caused by an integer signedness error in the ReadDCMImage function, located in codersdcm.c. This error can be exploited by a remote attacker using a specially crafted DCM file, leading to...

PT-2017-12962

Name of the Vulnerable Software and Affected Versions IBM API Connect version 5.0.6.0 Description The issue allows a remote attacker to perform an XML External Entity Injection XXE attack when the software processes XML data. This could lead to the exposure of highly sensitive information or the...

CVE-2017-1322: Improper Restriction of XML External Entity Reference

IBM API Connect 5.0.6.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125918...