CVE-2018-0189

CVE-2018-0189 describes a DoS vulnerability in Cisco IOS and IOS XE FIB code. The issue arises from how the Forwarding Information Base represents recursive routes; an unauthenticated, network attacker can inject a specific recursive pattern to cause a device to reload, leading to DoS. Affected p...

Fedora 27 : chromium (2018-faff5f661e)

The remote Fedora 27 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2018-faff5f661e advisory. Update to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs. CVE-2017-15396...

Fedora 26 : kernel (2018-ba39fc0e07)

Incremental update to fix kernel-devel issues. ---- The 4.15.12 update contains a variety of fixes across the tree. ---- The 4.15.11 update contains a number of important fixes across the tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedor...

Fedora 27 : php-simplesamlphp-saml2 (2018-6db40b0c37)

SSPSA 201803-01 / CVE-2018-7711 - SSPSA 201802-01 / CVE-2018-7644 - SSPSA 201801-01 / CVE-2018-6519 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...

Debian DLA-1319-1 : firefox-esr security update

Richard Zhu and Huzaifa Sidhpurwala discovered that an out-of-bounds memory write when playing Vorbis media files could result in the execution of arbitrary code. For Debian 7 'Wheezy', these problems have been fixed in version 52.7.2esr-1deb7u1. We recommend that you upgrade your firefox-esr...

Debian DLA-1315-1 : libvirt security update

Daniel P. Berrange and Peter Krempa of Red Hat discovered a flaw in libvirt, a virtualization API. A lack of restriction for the amount of data read by QEMU Monitor socket can lead to a denial of service by exhaustion of memory resources. For Debian 7 'Wheezy', these problems have been fixed in...

DLINK DCS-5020L - Remote Code Execution (PoC)

DLINK DCS-5020L - Remote Code Execution PoC “The DCS-5020L Wireless N Day & Night Pan/Tilt Cloud Camera is a day/night network camera that easily connects to your existing home network for remote viewing on a range of mobile devices. It features pan, tilt and digital zoom function to allow you to...

SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2018:0811-1)

This update for wireshark fixes the following issues: Security issue fixed bsc1082692 : - CVE-2018-7335: The IEEE 802.11 dissector could crash wnpa-sec-2018-05 - CVE-2018-7321: thrift long dissector loop dissectthriftmap - CVE-2018-7322: DICOM: inifinite loop dissectdcmtag - CVE-2018-7323: WCCP:...

SUSE SLES11 Security Update : ntp (SUSE-SU-2018:0808-1)

This update for ntp fixes the following issues: Security issues fixed : - CVE-2016-1549: Significant additional protections against CVE-2016-1549 that was fixed in ntp-4.2.8p7 bsc1082210. - CVE-2018-7170: Ephemeral association time spoofing additional protection bsc1083424. - CVE-2018-7182: Buffe...

Philips Alice 6 Vulnerabilities (Update B)

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low skill level to exploit/public exploits are available Vendor: Philips Equipment: Philips Alice 6 System product Vulnerabilities: Improper Authentication, Missing Encryption of Sensitive Data 2. UPDATE INFORMATION This updated...

Debian DLA-1317-1 : net-snmp security update

It was discovered that there was a heap corruption vulnerability in the net-snmp framework which exchanges server management information in a network. For Debian 7 'Wheezy', this issue has been fixed in net-snmp version 5.7.2.1+dfsg-1+deb8u1. We recommend that you upgrade your net-snmp packages...

Fedora 26 : monitorix (2018-1d3d0e6f2e)

Prior Monitorix versions are vulnerable to cross-site scripting XSS, caused by improper validation of user-supplied input by the monitorix.cgi file. A remote attacker could exploit this vulnerability using some of the arguments provided graph= or when= in a specially crafted URL to execute script...

Fedora 27 : php-simplesamlphp-saml2_3 (2018-37e28670f2)

SSPSA 201803-01 / CVE-2018-7711 - SSPSA 201802-01 / CVE-2018-7644 - SSPSA 201801-01 / CVE-2018-6519 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...

Fedora 26 : php-simplesamlphp-saml2 (2018-f4ab4d96f9)

SSPSA 201803-01 / CVE-2018-7711 - SSPSA 201802-01 / CVE-2018-7644 - SSPSA 201801-01 / CVE-2018-6519 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...

Fedora 27 : puppet (2018-45d8b8ae21)

Update to latest puppet 4 release 4.10.10. Fixing a minor security issue. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Virtuozzo 6 : parallels-server-bm-release / etc (VZA-2018-017)

According to the versions of the parallels-server-bm-release / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - In the Linux kernel through 4.14.13, the rdsmessageallocsgs function does not validate a value that is used during...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2018:0769-1)

This update for curl fixes the following issues: Following security issues were fixed : - CVE-2018-1000120: A buffer overflow exists in the FTP URL handling that allowed an attacker to cause a denial of service or possible code execution bsc1084521. - CVE-2018-1000121: A NULL pointer dereference...

Virtuozzo 7 : readykernel-patch (VZA-2018-015)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - It was discovered that the implementation of ebtables in the kernel did not properly validate the offsets received fro...

IBM DB2 9.7 < FP11 Special Build 37314 / 10.1 < FP6 Special Build 37313 / 10.5 < FP10 Special Build 37311 / 11.1.3 < FP3 JDBC Driver Unsafe Deserialization Local Privilege Escalation (UNIX)

According to its version, the installation of IBM DB2 running on the remote host is either 9.7 prior to Fix Pack 11 Special Build 37314, 10.1 prior to Fix Pack 6 Special Build 37313, 10.5 prior to Fix Pack 10 Special Build 37311, or 11.1.3 prior to Fix Pack 3. It is, therefore, affected by a loca...

The GDPR is Coming: We Shed Light on What’s Still Not Working

On May 25, the biggest shake-up to Europe’s data protection laws in almost a generation will finally take effect, after years of planning. For any US organization handling data on EU citizens, including service providers, it means you could face hefty fines of up to €20m $24.7m or 4% of global...