Design/Logic Flaw

In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to sndtimeropen and sndtimercloselocked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a...

UBUNTU-CVE-2019-19807

In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to sndtimeropen and sndtimercloselocked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a...

CVE-2019-19807

CVE-2019-19807 affects the Linux kernel before 5.3.11, due to a use-after-free in sound/core/timer.c (snd_timer_open/snd_timer_close_locked). The timeri variable was repurposed during a refactor, leading to a faulty lifecycle for a new timer instance. Connected sources confirm an upstream fix imp...

CVE-2019-13177

verification.py in django-rest-registration aka Django REST Registration library before 0.5.0 relies on a static string for signatures i.e., the Django Signing API is misused, which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to...

Design/Logic Flaw

verification.py in django-rest-registration aka Django REST Registration library before 0.5.0 relies on a static string for signatures i.e., the Django Signing API is misused, which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to...

PYSEC-2019-20

verification.py in django-rest-registration aka Django REST Registration library before 0.5.0 relies on a static string for signatures i.e., the Django Signing API is misused, which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to...

CVE-2019-13177

The CVE is supported by concrete details in connected sources: django-rest-registration before 0.5.0 misuses the Django Signer API by passing the salt as the secret key, resulting in static, easily guessable verification signatures. This allows remote attackers to spoof the verification process v...

CVE-2019-13177

verification.py in django-rest-registration aka Django REST Registration library before 0.5.0 relies on a static string for signatures i.e., the Django Signing API is misused, which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to...

Developers Versus Automation Engineers: How We Ended the Fighting with the Right CI Process

Hey developers and DevOps professionals: what if I told you that how you wrap and execute your automation tests could be the key to making your development process faster, more professional and stable, and stop the bickering between your developers and automation teams? This post will describe ho...

RUSTSEC-2018-0019 Multiple memory safety issues

Affected versions contain multiple memory safety issues, such as: - Unsoundly coercing immutable references to mutable references - Unsoundly extending lifetimes of strings - Adding the Send marker trait to objects that cannot be safely sent between threads This may result in a variety of memory...

Multiple memory safety issues

Affected versions contain multiple memory safety issues, such as: - Unsoundly coercing immutable references to mutable references - Unsoundly extending lifetimes of strings - Adding the Send marker trait to objects that cannot be safely sent between threads This may result in a variety of memory...

Vulchain scan workflow and search queries

This post will be about my Vulnerability Scanner project - Vulchain. Recently I've spent couple of my weekends almost exclusively on coding: refactoring the scan engine, creating API and GUI. I was doing it because of the conferences, where I will be speaking soon: April 11-13 CyberCentral in...

Security update for java-1_7_0-openjdk (important)

This update for java-170-openjdk fixes the following issues: Security issues fixed in OpenJDK 7u171 January 2018 CPUbsc1076366: - CVE-2018-2579: Improve key keying case - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages...

SUSE-SU-2018:0661-1 Security update for java-1_7_0-openjdk

This update for java-170-openjdk fixes the following issues: Security issues fixed in OpenJDK 7u171 January 2018 CPUbsc1076366: - CVE-2018-2579: Improve key keying case - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages...

Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2017-2998)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2998 advisory. 1:1.8.0.151-1.b12 - repack policies adapted to new counts and paths - note that also c-j-c is needed to make this apply in next update - Resolves:...

Fedora 24 : rpm-ostree (2017-788129b61c)

https://github.com/projectatomic/rpm-ostree/releases/tag/v2017.3 This release includes a fix for CVE-2017-2623. There are a few new features, such as systemctl reload rpm-ostreed now being supported. Some bugfixes such as memory leak fixes. Besides that, there's a lot of internal refactoring goin...

Fedora 25 : rpm-ostree (2017-003fa5648c)

https://github.com/projectatomic/rpm-ostree/releases/tag/v2017.3 This release includes a fix for CVE-2017-2623. There are a few new features, such as systemctl reload rpm-ostreed now being supported. Some bugfixes such as memory leak fixes. Besides that, there's a lot of internal refactoring goin...

CVE-2017-6438

Heap-based buffer overflow in the parseunicodenode function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service out-of-bounds write and possibly code execution via a crafted plist file...

Apache Tomcat information disclosure Vulnerability, CVE-2016-8747-a vulnerability warning-the black bar safety net

Release time: 2017-3-13 20:05:14 GMT Importance: medium Affected versions: Apache Tomcat 9.0.0. m11 to 9.0.0. m15 Apache Tomcat 8.5.7 to 8.5.9 Description: For a more extensive use of ByteBuffer in the refactoring introduced a regression that could cause the information on the same connection...

Mapbox: Mapbox Android SDK uses Broadcast Receiver instead of Local Broadcast Manager

Security researcher @mishre reported that the Mapbox Android SDK was using the Broadcast Receiver for location services requests and recommended that the switch be made to use the Local Broadcast Manager. The Local Broadcast Manager offers more granular control of broadcast permissions, as well a...