openSUSE: Security Advisory for rsyslog (openSUSE-SU-2019:2500-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : rsyslog (openSUSE-2019-2500)

This update for rsyslog fixes the following issues : Security issues fixed : - CVE-2019-17041: Fixed a heap overflow in the parser for AIX log messages bsc1153451. - CVE-2019-17042: Fixed a heap overflow in the parser for Cisco log messages bsc1153459. Other issue addressed : - Fixed an issue whe...

CVE-2017-18232

The Serial Attached SCSI SAS implementation in the Linux kernel mishandles a mutex within libsas. This allows local users to cause a denial of service deadlock by triggering certain error-handling code...

Kernel update: Virtuozzo ReadyKernel patch 83.0 for all supported Virtuozzo 7.0 and Virtuozzo Infrastructure Platform kernels

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to all supported kernels of Virtuozzo 7.0 and Virtuozzo Infrastructure Platform. Vulnerability id: PSBM-94882 3.10.0-862.9.1.vz7.63.3 to 3.10.0-957.12.2.vz7.86.2 It was found that the in-kernel...

Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities

FireEye Labs recently observed an attack against the government sector in Central Asia. The attack involved the new HAWKBALL backdoor being delivered via well-known Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802. HAWKBALL is a backdoor that attackers can use to collect...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of serviceDoS attacks. This is because the Serial Attached SCSI SAS implementation mishandles a mutex within libsas. This allows local users to cause a denial of service deadlock by triggering certain error-handling code...

EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1471)

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - drivers/hid/hid-zpff.c in the Human Interface Device HID subsystem in the Linux kernel through 3.11, when...

DEBIAN-CVE-2019-11366

An issue was discovered in atftpd in atftp 0.7.1. It does not lock the threadlistmutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If threaddata is NULL when assigned to current, a...

UBUNTU-CVE-2019-11366

An issue was discovered in atftpd in atftp 0.7.1. It does not lock the threadlistmutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If threaddata is NULL when assigned to current, a...

OPENSUSE-SU-2019:1250-1 Security update for glibc

This update for glibc fixes the following issues: Security issue fixed: - CVE-2016-10739: Fixed an improper implementation of getaddrinfo function which could allow applications to incorrectly assume that had parsed a valid string, without the possibility of embedded HTTP headers or other...

PT-2019-2187 · Atftp +3 · Atftp +3

Name of the Vulnerable Software and Affected Versions: atftp version 0.7.1 Description: The issue is related to the thread list mutex mutex in the atftpd component of atftp. It does not properly lock the mutex before assigning the current thread data structure, leading to a potential denial of...

SUSE-SU-2019:0903-1 Security update for glibc

This update for glibc fixes the following issues: Security issue fixed: - CVE-2016-10739: Fixed an improper implementation of getaddrinfo function which could allow applications to incorrectly assume that had parsed a valid string, without the possibility of embedded HTTP headers or other...

kernel: Mishandling mutex within libsas allowing local Denial of Service

The Serial Attached SCSI SAS implementation in the Linux kernel mishandles a mutex within libsas. This allows local users to cause a denial of service deadlock by triggering certain error-handling code...

kernel: Mishandling mutex within libsas allowing local Denial of Service

The Serial Attached SCSI SAS implementation in the Linux kernel mishandles a mutex within libsas. This allows local users to cause a denial of service deadlock by triggering certain error-handling code...

SUSE-SU-2018:3161-1 Security update for samba

Samba was updated to 4.6.15, bringing bug and security fixes. bsc1110943 Following security issues were fixed: - CVE-2018-10919: Fix unauthorized attribute access via searches. bsc1095057; Non-security bugs fixed: - Fix ctdbmutexcephradoshelper deadlock bsc1102230. - Allow idmaprid to have primar...

UBUNTU-CVE-2018-14438

In Wireshark through 2.6.2, the createapprunningmutex function in wsutil/fileutil.c calls SetSecurityDescriptorDacl to set a NULL DACL, which allows attackers to modify the access control arbitrarily...

Threat Roundup for June 29 to July 6th

Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we've observed this week — covering the dates between June 29 and July 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, it will summarize the threats we've observed by...

CVE-2016-10723

An issue was discovered in the Linux kernel through 4.17.2. Since the page allocator does not yield CPU resources to the owner of the oomlock mutex, a local unprivileged user can trivially lock up the system forever by wasting CPU resources from the page allocator e.g., via concurrent page fault...

CVE-2016-10723

An issue was discovered in the Linux kernel through 4.17.2. Since the page allocator does not yield CPU resources to the owner of the oomlock mutex, a local unprivileged user can trivially lock up the system forever by wasting CPU resources from the page allocator e.g., via concurrent page fault...

Google Android Qualcomm Qdsp6v2 Privilege Access Control Vulnerability

Android on Google Pixel and Nexus is an open source Linux-based operating system for the Google Pixel and Nexus smartphones developed by Google Inc. and the Open Handset Alliance OHA.The Qualcomm Qdsp6v2 is one of the Qualcomm Qualcomm digital signal processor components. A privilege access contr...