DLA-773-4 python-crypto - update

Bulletin has no description...

Microsoft Office CVE-2017-0003 Memory Corruption Vulnerability

Description Microsoft Office is prone to a remote memory-corruption vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. Technologies Affected...

PT-2017-1114 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 24.0.0.186 and earlier Description: The issue is related to errors in security settings, allowing a remote attacker to bypass security mechanisms due to the handling of TCP connections. This can enable attackers to...

ICSMA-17-009-01A_St. Jude Merlin@home Transmitter Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSMA-17-009-01 St. Jude Merlin@home Transmitter Vulnerability that was published January 9, 2017, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 5 -------- MedSec Holdings has identified a channel...

Description of Windows MultiPoint Server 2012 General Availability Cumulative Update

Description of Windows MultiPoint Server 2012 General Availability Cumulative Update Summary This article describes the Windows MultiPoint Server 2012 General Availability Cumulative Update that introduces support for the new USB-over-Ethernet client devices and drivers. Introduction This...

MS10-010: Vulnerability in Windows Server 2008 Hyper-V could allow denial of service

MS10-010: Vulnerability in Windows Server 2008 Hyper-V could allow denial of service INTRODUCTION Microsoft has released security bulletin MS10-010. To view the complete security bulletin, visit one of the following Microsoft Web sites: Home users:...

MGASA-2017-0007 Updated unrtf package fixes security vulnerability

A Stack-based buffer overflow has been found in unrtf 0.21.9, which affects functions including cmdexpand, cmdemboss and cmdengrave CVE-2016-10091...

DLA-773-2 python-crypto - regression update

Bulletin has no description...

MGASA-2016-0433 Updated mcabber packages fix security vulnerability

It was discovered that there was a "roster push attack" vulnerability in mcabber, a console-based Jabber XMPP client. A remote attacker can modify the roster and intercept messages via a crafted roster-push IQ stanza CVE-2016-9928...

MGASA-2016-0430 Updated roundcubemail packages fix security vulnerability

Users can execute commands on the server by writing e-mails, due to insufficient sanitation of the from field when calling PHP's mail function CVE-2016-9920. Note that only roundcubemail installations that don't have an SMTP server configured for mail delivery are affected...

Security Advisory - DoS Vulnerability in Multiple Huawei Devices

There is a denial of service DoS vulnerability in multiple Huawei devices. Due to the lack of input validation, a remote attacker may craft a malformed Resource Reservation ProtocolRSVP packet and send it to the device, causing a few buffer overflows and occasional device restart. Vulnerability I...

Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones

Factory Reset Protection FRP is a security method that was designed to make sure someone can't just wipe and factory reset the phone if user lost it or it was stolen. The FRP in some Huawei smart phones can be bypass. An attacker can bypass the FRP by special steps and wipe and factory reset the...

SUSE-SU-2016:3270-1 Security update for openjpeg2

This update for openjpeg2 fixes the following issues: CVE-2016-9114: NULL Pointer Access in function imagetopnm of convert.c:1943jp2 could lead to crash bsc1007740 CVE-2016-9115: Heap Buffer Overflow in function imagetotga of convert.cjp2 bsc1007741 CVE-2016-9580, CVE-2016-9581: Possible Heap...

JVN#96681653: WinSparkle issue where registry value is not validated

When an application that uses WinSparkle is launched, it checks the directory used by WinSparkle for temporary files and deletes any temporary files. This directory path is specified in a registry key. In a situation where an attacker has modified the specific registry value used by this library,...

JVN#90813656: Wireshark for Windows issue where an arbitrary file may be deleted

Wireshark for Windows uses a software updating library called WinSparkle. Wireshark for Windows contains an issue where an arbitrary directory of file may be deleted due to an issue contained in WinSparkle JVN96681653. Impact An arbitrary directory or file may be deleted with the privileges of th...

H2O use-after-free vulnerability

Overview H2O is an open source web server software. H2O contains a use-after-free vulnerability CWE-416 due to a flaw in the process of upgrading from HTTP/1 to HTTP/2. Kazuho Oku reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Kazuho Oku coordinated...

SKYSEA Client View vulnerable to arbitrary code execution

Overview SKYSEA Client View provided by Sky Co., LTD. is an Enterprise IT Asset Management Tool. SKYSEA Client View agent program contains an issue in processing authentication on the TCP communication with the management console program, which allows an attacker to execute an arbitrary code on t...

JVN#84995847: SKYSEA Client View vulnerable to arbitrary code execution

SKYSEA Client View provided by Sky Co., LTD. is an Enterprise IT Asset Management Tool. SKYSEA Client View agent program contains an issue in processing authentication on the TCP communication with the management console program, which allows an attacker to execute an arbitrary code on the client...

Cisco CloudCenter Orchestrator Docker Engine Privilege Escalation Vulnerability

A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator CCO; formerly CliQr could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system. The vulnerability is due to a misconfiguration that causes the Docker...

Cybozu Garoon fails to restrict access permission in To-Dos of Space function

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an access restriction flaw in To-Dos of Space function. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the...