Updated firefox packages fix security vulnerabilities

Updated firefox packages fix security vulnerabilities: Stack corruption due to incorrect number of arguments in WebRTC code. CVE-2019-13722 Buffer overflow in plain text serializer. CVE-2019-17005 Use-after-free in worker destruction. CVE-2019-17008 Updater temporary files accessible to...

Memory Leak

mongoose is vulnerable to memory leaks. Remote attackers could cause crash the application due to $versionError not being deleted which would lead to processes running out of memory...

Insights from one year of tracking a polymorphic threat

A little over a year ago, in October 2018, our polymorphic outbreak monitoring system detected a large surge in reports, indicating that a large-scale campaign was unfolding. We observed as the new threat attempted to deploy files that changed every 20-30 minutes on thousands of devices. We gave...

openSUSE Security Update : java-11-openjdk (openSUSE-2019-2557)

This update for java-11-openjdk to version jdk-11.0.5-10 fixes the following issues : Security issues fixed October 2019 CPU bsc1154212: - CVE-2019-2933: Windows file handling redux - CVE-2019-2945: Better socket support - CVE-2019-2949: Better Kerberos ccache handling - CVE-2019-2958: Build Bett...

CVE-2012-6136

tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes...

Code injection

tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes...

CVE-2012-6136

CVE-2012-6136 affects the Linux tuned daemon (e.g., tuned 2.10.0) where the PID file is created with insecure permissions, enabling local users to kill arbitrary processes. Technical details across multiple advisories (SUSE, Debian/Ubuntu, Red Hat) confirm the same root cause and impact. Remediat...

CVE-2019-14891

A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management conmon processes being killed if a workload process triggers an out-of-memory OOM condition for the cgroup. An attacker could abuse this flaw to get...

CVE-2010-4177

mysql-gui-tools mysql-query-browser and mysql-admin before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text form via the list of running processes...

Windows Certificate Dialog Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete...

CVE-2013-1820

tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service...

CVE-2013-1820

tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service...

CVE-2013-1820

tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service...

CVE-2013-1820

CVE-2013-1820 concerns the tuned daemon (tuned before 2.x) where insecure permissions on tuned’s ktune service allow local users to kill running processes. Multiple sources (NVD entry, Debian/Ubuntu advisories, Red Hat/Nessus plugins) confirm the vulnerability stems from improper access control o...

macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common()

On macOS, when a new mount point is created, the kernel uses checkdirs to, as a comment above the function explains: "Scan all active processes to see if any of them have a current or root directory onto which the new filesystem has just been mounted. If so, replace them with the new mount point....

The vulnerability of the ihevcd_parse_sps function (ihevcd_parse_headers.c) in the Android operating system allows a hacker to cause a system failure for critical system processes.

The vulnerability of the ihevcdparsesps function ihevcdparseheaders.c in the Android operating system is related to an infinite loop being entered. Exploiting this vulnerability could allow a malicious actor to cause a critical system process to fail remotely...

Video_Converter app denial of service vulnerability

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany.VideoConverter app is a video file format converter. A denial of service vulnerability exists in VideoConverter app version 0.1.0 for Nextcloud, which...

Design/Logic Flaw

The VideoConverter app 0.1.0 for Nextcloud allows denial of service CPU and memory consumption via multiple concurrent conversions because many FFmpeg processes may be running at once. The workload is not queued for serial execution...

Microsoft to Reward Hackers for Finding Bugs in Open Source Election Software

Fair elections are the lifelines of democracy, but in recent years election hacking has become a hot topic worldwide. Whether it's American voting machines during the 2016 presidential election or India's EVMs during 2014 general elections, the integrity, transparency, and security of electronic...

CVE-2019-3805

A flaw was discovered in wildfly that would allow local users, who are able to execute init.d script, to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root...