Fedora 26 : qt5-qtwebengine (2017-e83c26a8c9)

This update updates QtWebEngine to the 5.9.0 release. QtWebEngine 5.9.0 is part of the Qt 5.9.0 release, but only the QtWebEngine component is included in this update. The update fixes the following security issues in QtWebEngine 5.8.0: CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, CVE-2017-5009,...

USN-3321-1: Thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information or execute arbitrary...

[ASA-201707-4] qt5-webengine: multiple issues

Arch Linux Security Advisory ASA-201707-4 ========================================= Severity: Critical Date : 2017-07-04 CVE-ID : CVE-2017-5070 CVE-2017-5071 CVE-2017-5075 CVE-2017-5076 CVE-2017-5077 CVE-2017-5078 CVE-2017-5079 CVE-2017-5083 CVE-2017-5088 CVE-2017-5089 Package : qt5-webengine Typ...

[slackware-security] kernel

New kernel packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/linux-4.4.75/: Upgraded. This kernel fixes security issues that include possible stack exhaustion, memory corruption, and arbitrary co...

FortiWLM upgrade user account hard-coded credentials

FortiWLM has a hard-coded password for its "upgrade" user account, which it uses to transfer files to and from the FortiWLC controller. Having the upgrade account credentials would allow an attacker to transfer files to any attached or previously attached controllers as an admin user, thus raisin...

SUSE-SU-2017:1735-1 Security update for the Linux kernel

This Linux kernel update for SUSE Linux Enterprise 12 fixes the following issues: - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. bsc1045340...

SUSE-SU-2017:1714-1 Security update for apache2

This update for apache2 provides the following fixes: Security issues fixed: - CVE-2017-3167: In Apache use of httpd apgetbasicauthpw outside of the authentication phase could lead to authentication requirements bypass bsc1045065 - CVE-2017-3169: In modssl may have a dereference NULL pointer issu...

SUSE-SU-2017:1707-1 Security update for the Linux kernel

This Linux kernel update for SUSE Linux Enterprise 12 SP2 fixes the following issues: - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. bsc1045340...

Citrix XenServer Multiple Security Updates

Description of Problem A number of security issues have been identified within Citrix XenServer. These issues could, if exploited, allow a malicious administrator of a guest VM to compromise the host. The issues have the identifiers: CVE-2017-10920, CVE-2017-10921 and CVE-2017-10922 High: Grant...

SUSE-SU-2017:1663-1 Security update for wireshark

The network debugging tool wireshark was updated to version 2.2.7 to fix the following issues: - CVE-2017-9352: Bazaar dissector infinite loop wnpa-sec-2017-22 bsc1042304 - CVE-2017-9348: DOF dissector read overflow wnpa-sec-2017-23 bsc1042303 - CVE-2017-9351: DHCP dissector read overflow...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-52.2.0esr-i586-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...

SUSE-SU-2017:1538-1 Security update for libxml2

This update for libxml2 fixes the following security issues: CVE-2017-9050: A heap-based buffer over-read in xmlDictAddString bsc1039069, bsc1039661 CVE-2017-9049: A heap-based buffer overflow in xmlDictComputeFastKey bsc1039066 CVE-2017-9048: A stack overflow vulnerability in...

CVE-2017-4971: Spring WebFlow remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

Spring severe of these vulnerabilities have traditionally not too much, before the more serious that problem is Spring's JavaBean automatic binding function, the result can be control class, which can lead to the use of certain characteristics of the execution of arbitrary code, but that...

[SECURITY] Fedora 26 Update: lynis-2.5.0-1.fc26

Lynis is an auditing and hardening tool for Unix/Linux and you might even c all it a compliance tool. It scans the system and installed software. Then it performs many individual security control checks. It determines the hardeni ng state of the machine, detects security issues and provides...

[slackware-security] irssi

New irssi packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/irssi-1.0.3-i586-1slack14.2.txz: Upgraded. Fixed security issues that may result in a denial of service...

Robert 0.5 - Multiple Vulnerabilities

Robert 0.5 - Multiple Vulnerabilities Exploit Title: Robert 0.5 - Multiple Vulnerabilities XSS, CSRF, Directory traversal & SQLi Date: 07/06/2017 Exploit Author: Cyril Vallicari / HTTPCS - ZIWIT Vendor website :http://robert.polosson.com/ Download link :...

GitLab -- Various security issues

GitLab reports: Please reference CVE/URL list for details...

[ASA-201706-8] chromium: multiple issues

Arch Linux Security Advisory ASA-201706-8 ========================================= Severity: Critical Date : 2017-06-07 CVE-ID : CVE-2017-5070 CVE-2017-5071 CVE-2017-5072 CVE-2017-5073 CVE-2017-5074 CVE-2017-5075 CVE-2017-5076 CVE-2017-5077 CVE-2017-5078 CVE-2017-5079 CVE-2017-5080 CVE-2017-5081...

How to use JavaScript array extensions integer overflow vulnerabilities in WebKit-a vulnerability warning-the black bar safety net

I will be in this article to tell you about the vulnerability, CVE-2017-2536/ZDI-17-358, which is a typical plastic overflow vulnerability, when the system is in the calculation of the allocated space size, the vulnerability will likely lead to a heap buffer overflow. We not only give you...

Lessons Learned from SQL Injection Fix in Joomla 3.7.0

The Joomla community recently patched a SQL injection vulnerability introduced in Joomla 3.7.0. The article reporting this vulnerability explains how to identify the vulnerability which was discovered via static code analysis and how to craft an attack, e.g...