[SECURITY] Fedora 29 Update: libssh-0.8.4-1.fc29

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, tra nsfer files, use a secure and transparent tunnel for your remote...

EulerOS Virtualization 2.5.1 : mariadb (EulerOS-SA-2018-1337)

According to the versions of the mariadb packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - mysql: Client programs unspecified vulnerability CPU Jul 2017 CVE-2017-3636 - mysql: Server: DML unspecified vulnerability CPU J...

CVE-2017-18348

Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privileges by leveraging access to that non-root account to modify $SPLUNKHOME/etc/splunk-launch.conf and insert Trojan horse programs into $SPLUNKHOME/bin, becau...

CVE-2018-3174

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the...

CVE-2018-3174: Undefined Security Weakness

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the...

Oracle MySQL Server Denial of Service Vulnerability (CNVD-2018-21489)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Client programs subcomponent of the MySQL Server component of Oracle MySQL. An attacker could exploit this...

PT-2018-2418

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 5.5.61 and prior Oracle MySQL versions 5.6.41 and prior Oracle MySQL versions 5.7.23 and prior Oracle MySQL versions 8.0.12 and prior Description The issue is related to the Client programs component of Oracle MySQL Serve...

Standing behind “MSRC Listens”

Last week at BlueHat’s “MSRC Listens” session, I took the stage with Mechele Gruhn, manager of the Vulnerability Response PM team, to explain how MSRC is changing our communication, workflows, and tooling to deliver an improved user experience for our partners in the security research community. ...

EulerOS 2.0 SP3 : mariadb (EulerOS-SA-2018-1303)

According to the versions of the mariadb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - mysql: Client programs unspecified vulnerability CPU Jul 2017 CVE-2017-3636 - mysql: Server: DML unspecified vulnerability CPU Jul 2017...

Input validation

Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially execute arbitrary programs on user machine via a crafted HTML page...

CVE-2018-6043

Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially execute arbitrary programs on user machine via a crafted HTML page...

CVE-2018-6043

Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially execute arbitrary programs on user machine via a crafted HTML page...

CVE-2018-6043

Removed by vendor...

CVE-2018-17293

An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function, which allows attackers to cause a denial of service application...

CVE-2018-17293: NULL Pointer Dereference

An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function, which allows attackers to cause a denial of service application...

PT-2018-13974

Name of the Vulnerable Software and Affected Versions WAVM versions prior to 2018-09-16 Description An issue in the run function in Programs/wavm/wavm.cpp allows attackers to cause a denial of service or possibly have other impacts by crafting certain WebAssembly files. This occurs because the...

Amazon Linux 2 : mariadb (ALAS-2018-1078)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 5.5.57 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

[SECURITY] Fedora 27 Update: community-mysql-5.7.23-1.fc27

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon mysqld and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files...

chromium-browser: User confirmation bypass in external protocol handling

The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain operations to open external programs via a crafted HTML page...

The Vulnerability Disclosure Process: Still Broken

Despite huge progress in the vulnerability disclosure process, things remain broken when it comes to vendor-researcher relationships. Case in point: Last year when Leigh-Anne Galloway a cybersecurity resilience lead at Positive Technologies found a gaping hole in the Myspace website, she reported...