Fedora 30 : php (2019-be4f895015)

"PHP version 7.3.6 30 May 2019 cURL: - Implemented FR php72189 Add missing CURLVERSION constants. Javier Spagnoletti EXIF: - Fixed bug php77988 heap-buffer-overflow on phpjpgget16. CVE-2019-11040 Stas FPM: - Fixed bug php77934 php-fpm kill -USR2 not working. Jakub Zelenka - Fixed bug php77921...

HPE Intelligent Management Center (IMC) TopoMsgServlet Java Reflection Remote Code Execution Vulnerability

HPE Intelligent Management Center IMC is a comprehensive management platform built from the ground up to support the Failure, Configuration, Accounting, Performance and Security FCAPS model. A TopoMsgServlet Java reflection remote code execution vulnerability exists in HPE Intelligent Management...

EulerOS 2.0 SP5 : freeradius (EulerOS-SA-2019-1574)

According to the version of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - freeradius: eap-pwd: fake authentication using reflection CVE-2019-11234 Note that Tenable Network Security has extracted the preceding...

The original Java deserialization remote execution vulnerabilities so simple-vulnerability warning-the black bar safety net

Here we for Java deserialization issue caused remote code execution vulnerability principles are introduced. In order to simplify the description,without introducing a 3rd party library under the premise of the Operation, HOPE can serve to initiate the effect. There are 3 main parts: The Java...

Authentication Bypass

FreeRADIUS is vulnerable to authentication bypass. Remote unauthenticated attackers could exploit a flaw since the application does not prevent the use of reflection for authentication spoofing, aka a "Dragonblood" issue...

freeradius: eap-pwd: fake authentication using reflection

FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497...

Fedora 30 : php (2019-6350c4e21a)

PHP version 7.3.5 02 May 2019 Core: - Fixed bug php77903 ArrayIterator stops iterating after offsetSet call. Nikita CLI: - Fixed bug php77794 Incorrect Date header format in built-in server. kelunik EXIF - Fixed bug php77950 Heap-buffer-overflow in estrndup via exifprocessIFDTAG. CVE-2019-11036...

Fedora 28 : php (2019-bab3944fee)

PHP version 7.2.18 02 May 2019 CLI: - Fixed bug php77794 Incorrect Date header format in built-in server. kelunik EXIF - Fixed bug php77950 Heap-buffer-overflow in estrndup via exifprocessIFDTAG. CVE-2019-11036 Stas Interbase: - Fixed bug php72175 Impossibility of creating multiple connections to...

Fedora 29 : php (2019-6e325234a4)

PHP version 7.2.18 02 May 2019 CLI: - Fixed bug php77794 Incorrect Date header format in built-in server. kelunik EXIF - Fixed bug php77950 Heap-buffer-overflow in estrndup via exifprocessIFDTAG. CVE-2019-11036 Stas Interbase: - Fixed bug php72175 Impossibility of creating multiple connections to...

Scientific Linux Security Update : freeradius on SL7.x x86_64 (20190509)

Security Fixes : - freeradius: eap-pwd: authentication bypass via an invalid curve attack CVE-2019-11235 - freeradius: eap-pwd: fake authentication using reflection CVE-2019-11234 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...

freeradius: eap-pwd: fake authentication using reflection

FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497...

Sandbox Restrictions Bypass

openjdk is vulnerable to sandbox restrictions bypass. An improper permission check issue was discovered in the reflection API in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions...

Arbitrary Code Execution

Oracle Java SE is vulnerable to arbitrary code execution attacks. Remote unauthenticated attackers could execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager...

PT-2019-5313

Name of the Vulnerable Software and Affected Versions Infinispan affected versions not specified Description The issue is related to the invokeAccessibly method in the ReflectionUtil public class, which allows an application to invoke private methods in any class with Infinispan's privileges. Thi...

DEBIAN-CVE-2019-11234

FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497...

ALPINE-CVE-2019-11234

FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497...

CVE-2019-11234

FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497...

CVE-2019-9497: Reflection Attack in an Authentication Protocol

The implementations of EAP-PWD in hostapd EAP Server and wpasupplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not...

Preparing the Internet for the Next Mega DDoS Attack

When you think of a distributed denial-of-service DDoS attack at this point in the age of the internet, you might be thinking they’re old news. But when a multi-million-dollar business can be easily taken offline by an unskilled adversary and a $5 rent-a-DDoS service, I would argue that the issue...

Debian: Security Advisory (DSA-4430-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...