Moderate: Red Hat Security Advisory: NetworkManager and libnl3 security, bug fix and enhancement update

An update for NetworkManager, NetworkManager-libreswan, libnl3, and network-manager-applet is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

DEBIAN-CVE-2017-7542

The ip6find1stfragopt function in net/ipv6/outputcore.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service integer overflow and infinite loop by leveraging the ability to open a raw socket...

UBUNTU-CVE-2017-7542

The ip6find1stfragopt function in net/ipv6/outputcore.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service integer overflow and infinite loop by leveraging the ability to open a raw socket...

CVE-2017-2344

A routine within an internal Junos OS sockets library is vulnerable to a buffer overflow. Malicious exploitation of this issue may lead to a denial of service kernel panic or be leveraged as a privilege escalation through local code execution. The routines are only accessible via programs running...

CVE-2017-2344 Junos: Buffer overflow in sockets library

A routine within an internal Junos OS sockets library is vulnerable to a buffer overflow. Malicious exploitation of this issue may lead to a denial of service kernel panic or be leveraged as a privilege escalation through local code execution. The routines are only accessible via programs running...

Juniper Networks Junos OS Sockets Library Buffer Overflow Vulnerability

Junos OS is prone to a buffer overflow vulnerability in the sockets library. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2017-11505 · Mysql Server +3 · Dbd::Mysql +3

Name of the Vulnerable Software and Affected Versions: DBD::mysql versions through 4.043 Description: The issue allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack. This occurs because the mysql ssl=1 setting is used to mean that SSL is optional, despite the...

Back That App Up: Gaining Root on the Lenovo Vibe

In May of 2016, Mandiant’s Red Team discovered a series of vulnerabilities present on Lenovo’s Vibe P1 Android-based mobile device that allow local privilege escalation to the user “root”. Mandiant disclosed these vulnerabilities to Lenovo in May of 2016. Lenovo advised Mandiant that it should wo...

Back That App Up: Gaining Root on the Lenovo Vibe

In May of 2016, Mandiant’s Red Team discovered a series of vulnerabilities present on Lenovo’s Vibe P1 Android-based mobile device that allow local privilege escalation to the user “root”. Mandiant disclosed these vulnerabilities to Lenovo in May of 2016. Lenovo advised Mandiant that it should wo...

OSRAM SYLVANIA Osram Lightify Home Man-in-the-Middle Attack Vulnerability

OSRAM SYLVANIA Osram Lightify Home is a set of open IoT platforms for automated control of lighting devices from OSRAM Germany. OSRAM SYLVANIA Osram Lightify Home A security vulnerability exists in versions 2016-07-26 and earlier, which stems from the program's failure to use SSL pinning.An...

SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS

A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients...

openssl: Possible integer overflow vulnerabilities in codebase

Multiple integer overflow flaws were found in the way OpenSSL performed pointer arithmetic. A remote attacker could possibly use these flaws to cause a TLS/SSL server or client using OpenSSL to crash...

USN-3311-2: libnl vulnerability

USN-3311-1 fixed a vulnerability in libnl. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that libnl incorrectly handled memory when performing certain operations. A local attacker could possibly use this issue to cause libnl to...

Kibana Denial of Service Vulnerability

Kibana is an open source data visualization plugin for Elasticsearch. A denial of service vulnerability exists in Kibana. When configured for SSL client access, file descriptors fail to clear after certain requests and can accumulate over time, causing the process to crash...

Cayuga Lake National Bank Information Disclosure Breach

Cayuga Lake National Bank is a Banking Services app. cayuga-lake-national-bank/id1151601539 app 4.0.1 for iOS fails to validate SSL servers with X.509 certificates, allowing man-in-the-middle attackers to spoof servers and gain access to sensitive information by crafting certificates...

CVE-2017-9588

The "Oritani Mobile Banking" by Oritani Bank app 3.0.0 -- aka oritani-mobile-banking/id778851066 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9587

The "PCSB BANK Mobile" by PCSB Bank app 3.0.4 -- aka pcsb-bank-mobile/id1067472090 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9559

The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9577

The "First Citizens Bank-Mobile Banking" by First Citizens Bank AL app 3.0.0 -- aka first-citizens-bank-mobile-banking/id566037101 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2017-9587

The "PCSB BANK Mobile" by PCSB Bank app 3.0.4 -- aka pcsb-bank-mobile/id1067472090 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...