USN-4041-1: Linux kernel update | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description USN-4017-1 fixed vulnerabilities in the Linux kernel for Ubuntu. Unfortunately, the update introduced a regression that interfered with networking applications that setup very low SOSNDBUF values. This...

[SECURITY] [DLA 1846-2] unzip regression update

Package : unzip Version : 6.0-16+deb8u5 CVE ID : CVE-2019-13232 Debian Bug : 932404 The unzip security update issued as DLA 1846-1 caused a regression when building the Firefox web browser from source. There is a zip-like file in the Firefox distribution, omni.ja, which is a zip container with th...

DLA-1846-2 unzip - regression update

Bulletin has no description...

ffmpeg/ffmpeg_DEMUXER_fuzzer: Index-out-of-bounds in cbs_av1_read_frame_size_with_refs

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5758807440883712 Project: ffmpeg Fuzzer: libFuzzerffmpegDEMUXERfuzzer Fuzz target binary: ffmpegDEMUXERfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash...

llvm/llvm-dwarfdump-fuzzer: Heap-buffer-overflow in llvm::object::ELFObjectFile<llvm::object::ELFType<

Detailed report: https://oss-fuzz.com/testcase?key=5687643842543616 Project: llvm Fuzzer: libFuzzerllvmllvm-dwarfdump-fuzzer Fuzz target binary: llvm-dwarfdump-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6220000018fc Crash State:...

GHSA-HF23-9PF7-388P Deserialization of Untrusted Data and Code Injection in xstream

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON...

DLA-1730-3 libssh2 - regression update

Bulletin has no description...

EulerOS 2.0 SP8 : python3 (EulerOS-SA-2019-1778)

According to the version of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an...

EulerOS 2.0 SP8 : python2 (EulerOS-SA-2019-1771)

According to the version of the python2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1948-1) (SACK Panic) (SACK Slowness)

This update for the Linux Kernel 4.4.121-92104 fixes several issues. The following security issues were fixed : CVE-2019-11477: Jonathan Looney discovered that the TCPSKBCBskb-tcpgsosegs value was subject to an integer overflow when handling TCP Selective Acknowledgments SACKs. A remote attacker...

Debian DLA-1862-1 : linux security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2019-2101 Andrey Konovalov discovered that the USB Video Class driver uvcvideo did not consistently handle a type field in device descriptors, whic...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1924-1) (SACK Panic) (SACK Slowness)

This update for the Linux Kernel 3.12.74-6064104 fixes several issues. The following security issues were fixed : CVE-2019-11477: Jonathan Looney discovered that the TCPSKBCBskb-tcpgsosegs value was subject to an integer overflow when handling TCP Selective Acknowledgments SACKs. A remote attacke...

DEBIAN-CVE-2019-10173

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON...

CVE-2019-10173

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON...

UBUNTU-CVE-2019-10173

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON...

Deserialization of untrusted data

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON...

CVE-2019-10173

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON...

CVE-2019-10173

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON...

SUSE-SU-2019:1935-1 Security update for the Linux Kernel (Live Patch 26 for SLE 12 SP3)

This update for the Linux Kernel 4.4.180-9497 fixes one issue. The following security issue was fixed: This update contains a regression fix for CVE-2019-11478 bsc1140747...

SUSE-SU-2019:1948-1 Security update for the Linux Kernel (Live Patch 25 for SLE 12 SP3)

This update for the Linux Kernel 4.4.178-9491 fixes several issues. The following security issues were fixed: - CVE-2019-11477: Jonathan Looney discovered that the TCPSKBCBskb-tcpgsosegs value was subject to an integer overflow when handling TCP Selective Acknowledgments SACKs. A remote attacker...