EulerOS 2.0 SP2 : netpbm (EulerOS-SA-2019-2426)

According to the versions of the netpbm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The pmmallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03 allows remote attackers to cause a denial of service heap-based...

EulerOS 2.0 SP2 : tcpdump (EulerOS-SA-2019-2435)

According to the versions of the tcpdump package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - tcpdump 4.9.0 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via crafted packet data. Th...

EulerOS 2.0 SP2 : elfutils (EulerOS-SA-2019-2510)

According to the versions of the elfutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Divide-by-zero vulnerabilities in the function arlibaddsymbols in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of servic...

EulerOS 2.0 SP2 : libcroco (EulerOS-SA-2019-2520)

According to the versions of the libcroco package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The crtknzrparsecomment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service memory allocation error...

Android Ups the Mobile Security Ante with Default TLS Encryption

A full 80 percent of Android apps are encrypting their traffic by default, according to a Transport Layer Security TLS adoption update from Google. That percentage is even greater for apps targeting Android 9 and higher, with 90 percent of those encrypting traffic by default, the tech giant said ...

Debian DLA-2005-1 : tnef security update

In tnef, an attacker may be able to write to the victim's .ssh/authorizedkeys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup. For Debian 8 'Jessie', this problem has been fixed in version...

EulerOS Virtualization for ARM 64 3.0.3.0 : libtiff (EulerOS-SA-2019-2323)

According to the version of the libtiff package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - TIFFWriteScanline in tifwrite.c in LibTIFF 3.8.2 has a heap-based buffer over-read, as demonstrated by...

EulerOS Virtualization for ARM 64 3.0.3.0 : libarchive (EulerOS-SA-2019-2322)

According to the versions of the libarchive package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - libarchive 3.3.2 allows remote attackers to cause a denial of service xmldata heap-based buffer over-read and...

EulerOS Virtualization for ARM 64 3.0.3.0 : elfutils (EulerOS-SA-2019-2313)

According to the versions of the elfutils packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarfgetabbrev in dwarfgetabbrev.c and...

EulerOS Virtualization for ARM 64 3.0.3.0 : jasper (EulerOS-SA-2019-2332)

According to the versions of the jasper package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2encode which failed to check to see if the...

MGASA-2019-0346 Updated djvulibre packages fix security vulnerabilities

The updated packages fix security vulnerabilities: In DjVuLibre 3.5.27, DjVmDir.cpp in the DJVU reader component allows attackers to cause a denial-of-service application crash in GStringRep::strdup in libdjvu/GString.cpp caused by a heap-based buffer over-read by crafting a DJVU file...

Debian: Security Advisory (DLA-2005-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2019:3094-1 Security update for ncurses

This update for ncurses fixes the following issues: Security issue fixed: - CVE-2018-10754: Fixed a denial of service caused by a NULL Pointer Dereference in the ncparseentry bsc1131830. - CVE-2019-17594: Fixed a heap-based buffer over-read in ncfindentry function in tinfo/comphash.c bsc1154036. ...

tcpdump security update

14:4.9.2-4.1 - Resolves: 1761349 - CVE-2018-19519 tcpdump: Stack-based buffer over-read in print-hncp.c...

EulerOS 2.0 SP8 : tcpdump (EulerOS-SA-2019-2305)

According to the versions of the tcpdump package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers ...

EulerOS 2.0 SP8 : ncurses (EulerOS-SA-2019-2292)

According to the versions of the ncurses packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There is a heap-based buffer over-read in the ncfindentry function in tinfo/comphash.c in the terminfo library in ncurses before...

RHEL 7 : tcpdump (RHSA-2019:3976)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:3976 advisory. The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a...

Code injection

On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript running within the KaiOS browser, to view and edit the device's firmware over-the-air update settings. This web API is normally used by the system application...

CVE-2019-16243

CVE-2019-16243 affects TCL Alcatel Cingular Flip 2 B9HUAH1. An undocumented web API accessible from unprivileged JavaScript (including KaiOS browser) lets an attacker view and edit the device’s firmware OTA update settings; this API is normally used by OmaService.js by the system app. The root ca...

Low: Red Hat Security Advisory: tcpdump security update

An update for tcpdump is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...