CVE-2016-0883

CVE-2016-0883 affects Pivotal Cloud Foundry Ops Manager prior to 1.5.14 and 1.6.x prior to 1.6.9. The issue is that the same cookie-encryption key was used across different customers’ installations, enabling remote attackers to bypass session authentication by leveraging knowledge of the key from...

CVE-2016-0896

CVE-2016-0896 affects Pivotal Cloud Foundry Elastic Runtime. The issue occurs when older releases (1.6.x before 1.6.34 and 1.7.x before 1.7.12) place the 169.254.0.0/16 range into the all_open Application Security Group, potentially allowing remote attackers who can access the 169.254.169.254 add...

CVE-2016-0927

The CVE-2016-0927 issue affects Pivotal Cloud Foundry (PCF) Ops Manager, specifically versions before 1.6.17. Descriptions across multiple sources identify a cross-site scripting (XSS) or HTML injection vulnerability that allows remote attackers to inject arbitrary scripts or HTML via unspecified...

CVE-2016-0929

What is affected: RabbitMQ for Pivotal Cloud Foundry (PCF) 1.6.x (metrics-collection component) before 1.6.4. Vulnerability details: The metrics-collection component logs command lines of failed commands, which may allow context-dependent attackers to read log data and obtain sensitive informatio...

CVE-2016-0897

CVE-2016-0897 affects Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8 when using vCloud or vSphere. The issue is that SSH access for operators is not properly enabled, with unspecified impact and remote attack vectors. The available documents do not provide concrete r...

SUSE-RU-2015:1021-1 Recommended update for freetype2

This update for freetype2 adjusts the patch that fixed CVE-2014-9671 for better backwards compatibility. As the PCF format doesn't have an official specification, we have to exactly follow X11's pcfWriteFont and pcfReadFont functions' behavior...

IBM WebSphere MQ 'PCF Response Message Handling' DoS Vulnerability (Jun 2015)

IBM WebSphere MQ is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

IBM WebSphere MQ 7.0 / 7.1 / 7.5 / 8.0 PCF Query DoS

The version of IBM WebSphere MQ server installed on the remote Windows host is either 7.0 without fix pack 7.0.1.13, 7.1 without fix pack 7.1.0.6, 7.5 without fix pack 7.5.0.5, or 8.0 without fix pack 8.0.0.1. It is,therefore, affected by a denial of service vulnerability. A remote, authenticated...

freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

Multiple integer signedness errors in the pcfgetencodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service integer overflow, NULL pointer dereference, and application crash via a crafted PCF file that specifies negative values for the first...

freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

Off-by-one error in the pcfgetproperties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted PCF file with a 0xffffffff size value that is improperly incremented...

Design/Logic Flaw

IBM WebSphere MQ 7.0.1 before 7.0.1.13, 7.1 before 7.1.0.6, 7.5 before 7.5.0.5, and 8 before 8.0.0.1 allows remote authenticated users to cause a denial of service queue-slot exhaustion by leveraging PCF query privileges for a crafted query...

CVE-2014-4771

CVE-2014-4771 affects IBM WebSphere MQ: remote authenticated users can exhaust queue slots via a crafted PCF query, impacting MQ servers in versions 7.0.1 before 7.0.1.13, 7.1 before 7.1.0.6, 7.5 before 7.5.0.5, and 8 before 8.0.0.1. The connected documents confirm the affected versions and the D...

FreeType 'pcf_get_properties' Denial of Service Vulnerability

FreeType is a library of popular font functions. A denial of service vulnerability exists in FreeType 'pcfgetproperties' that allows remote attackers to launch a denial of service attack by crafting a PCF file...

Multiple integer overflow vulnerabilities in FreeType 'pcf_get_encodings'

FreeType is a library of popular font functions. Multiple integer overflow vulnerabilities in FreeType 'pcfgetencodings' allow remote attackers to launch a denial of service attack via a crafted PCF file that specifies negative values...

DEBIAN-CVE-2014-9671

Off-by-one error in the pcfgetproperties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted PCF file with a 0xffffffff size value that is improperly incremented...

CVE-2014-9671

Off-by-one error in the pcfgetproperties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted PCF file with a 0xffffffff size value that is improperly incremented...

CVE-2014-9670

Multiple integer signedness errors in the pcfgetencodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service integer overflow, NULL pointer dereference, and application crash via a crafted PCF file that specifies negative values for the first...

DEBIAN-CVE-2014-9670

Multiple integer signedness errors in the pcfgetencodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service integer overflow, NULL pointer dereference, and application crash via a crafted PCF file that specifies negative values for the first...

CVE-2014-9670

Multiple integer signedness errors in the pcfgetencodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service integer overflow, NULL pointer dereference, and application crash via a crafted PCF file that specifies negative values for the first...

Null pointer dereference

Off-by-one error in the pcfgetproperties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted PCF file with a 0xffffffff size value that is improperly incremented...