EulerOS 2.0 SP5 : ghostscript (EulerOS-SA-2019-1065)

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ghostscript: access bypass in psi/zdevice2.c 700153 CVE-2018-19475 - ghostscript: access bypass in psi/zicc.c 700169 CVE-2018-19476 -...

EulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-1027)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdromioctldrivestatus in drivers/cdrom/cdrom.c could be used b...

ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317)

It was found that ghostscript could leak sensitive operators on the operand stack when a pseudo-operator pushes a subroutine. A specially crafted PostScript file could use this flaw to escape the -dSAFER protection in order to, for example, have access to the file system outside of the SAFER...

Ghostscript 9.26 - Pseudo-Operator Remote Code Execution Exploit

Ghostscript 9.26 - Pseudo-Operator Remote Code Execution Exploit I noticed ghostscript 9.26 was released, so had a quick look and spotted some errors. For background, this is how you define a subroutine in postscript: /hello hello\n print def That's simple enough, but because a subroutine is just...

Ghostscript 9.26 - Pseudo-Operator Remote Code Execution

I noticed ghostscript 9.26 was released, so had a quick look and spotted some errors. For background, this is how you define a subroutine in postscript: /hello hello\n print def That's simple enough, but because a subroutine is just an executable array of commands, you need to mark it as...

CVE-2019-6116

It was found that ghostscript could leak sensitive operators on the operand stack when a pseudo-operator pushes a subroutine. A specially crafted PostScript file could use this flaw to escape the -dSAFER protection in order to, for example, have access to the file system outside of the SAFER...

SUSE-SU-2019:0144-1 Security update for ghostscript

This update for ghostscript to version 9.26a fixes the following issues: Security issue fixed: - CVE-2019-6116: subroutines within pseudo-operators must themselves be pseudo-operators bsc1122319...

Denial Of Service (DoS)

thunderbird is vulnerable to denial of service DoS attacks. The vulnerability exists as an out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data...

Ryuk Ransomware Attack: Rush to Attribution Misses the Point

ARCHIVED STORY Ryuk Ransomware Attack: Rush to Attribution Misses the Point By John Fokker · January 09, 2019 Senior analyst Ryan Sherstobitoff contributed to this report. During the past week, an outbreak of Ryuk ransomware that impeded newspaper printing services in the United States has garner...

PHP 7.0.x < 7.0.1 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.1. It is, therefore, affected by multiple vulnerabilities : - A use-after-free error exists in the collatorsortwithsortkeys function due to improper clearing of pointers when destroying an array. An...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:4069-1)

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device with zero interfaces that is mishandled i...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4307)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4307 advisory. - ntty: fix EXTPROC vs ICANON interaction with TIOCINQ aka FIONREAD Linus Torvalds Orabug: 28855335 CVE-2018-18386 - ALSA: seq: Fix regression by...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:3772-1)

This update for the Linux Kernel 3.12.74-6064107 fixes one issue. The following security issue was fixed : CVE-2018-18386: The drivers/tty/ntty.c allowed local attackers who are able to access pseudo terminals to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus...

SUSE-SU-2018:3772-1 Security update for the Linux Kernel (Live Patch 31 for SLE 12 SP1)

This update for the Linux Kernel 3.12.74-6064104 fixes one issue. The following security issue was fixed: - CVE-2018-18386: The drivers/tty/ntty.c allowed local attackers who are able to access pseudo terminals to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus...

SUSE-SU-2018:3688-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.162 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-14633: A security flaw was found in the chapservercomputemd5 function in the ISCSI target code in a way an authentication request from an ISC...

Linux kernel denial of service vulnerability (CNVD-2018-26907)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the drivers/tty/ntty.c file in the Linux kernel. A local attacker could exploit this vulnerability to hang a pseudo-terminal device ...

CVE-2018-18386

drivers/tty/ntty.c in the Linux kernel before 4.14.11 allows local attackers who are able to access pseudo terminals to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ...

Type confusion

drivers/tty/ntty.c in the Linux kernel before 4.14.11 allows local attackers who are able to access pseudo terminals to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ...

CVE-2018-18386

drivers/tty/ntty.c in the Linux kernel before 4.14.11 allows local attackers who are able to access pseudo terminals to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ...

DEBIAN-CVE-2018-18386

drivers/tty/ntty.c in the Linux kernel before 4.14.11 allows local attackers who are able to access pseudo terminals to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ...