CVE-2019-2436 vulnerabilities

Vulnerabilities for packages: mysql...

CVE-2018-20699 vulnerabilities

Vulnerabilities for packages: beats-fips, beats...

Machine Learning to Detect Software Vulnerabilities

No one doubts that artificial intelligence AI and machine learning ML will transform cybersecurity. We just don't know how, or when. While the literature generally focuses on the different uses of AI by attackers and defenders ­ and the resultant arms race between the two ­ I want to talk about...

CVE-2018-19360 vulnerabilities

Vulnerabilities for packages: hive...

MGASA-2018-0470 Updated openssl packages fix security vulnerabilities

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a Affected 1.1.1. Fixed in OpenSSL 1.1.0j Affected 1.1.0-1.1.0i. Fixed in OpenSSL 1.0.2q...

MGASA-2018-0451 Updated gdal packages fix security vulnerabilities

A flaw was found in gdal up to version 2.3.0. A Heap-buffer-overflow in GTiffOddBitsBand::IReadBlock. A flaw was found in gdal. A Heap-buffer-overflow in NITFRasterBand::Unpack. A flaw was found in gdal up to version 2.3.0. An Index-out-of-bounds in CPLErrorSetState...

CVE-2018-12414 TIBCO Rendezvous Vulnerable to CSRF Attacks

The Rendezvous Routing Daemon rvrd, Rendezvous Secure Routing Daemon rvrsd, Rendezvous Secure Daemon rvsd, Rendezvous Cache rvcache, and Rendezvous Daemon Manager rvdm components of TIBCO Software Inc.'s TIBCO Rendezvous, TIBCO Rendezvous Developer Edition, TIBCO Rendezvous for z/Linux, TIBCO...

SUSE-SU-2018:3609-1 Security update for ffmpeg

This update for ffmpeg fixes the following issues: - CVE-2018-13300: An improper argument passed to the avprivrequestsample function may have triggered an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure bsc11003...

CVE-2018-0735 vulnerabilities

Vulnerabilities for packages: mysql...

SUSE-SU-2018:2530-2 Security update for openssh

This update for openssh fixes the following issues: Security issue fixed: - CVE-2016-10708: Prevent DoS due to crashes caused by out-of-sequence NEWKEYS message bsc1076957...

CVE-2018-3285 vulnerabilities

Vulnerabilities for packages: mysql...

CVE-2018-3161 vulnerabilities

Vulnerabilities for packages: mysql...

CVE-2018-3143 vulnerabilities

Vulnerabilities for packages: mysql...

2018 Has Been Open Season on Open Source Supply Chains

As the number of open source components used in software supply chains shoot up, hackers are going along for the ride. Increasingly threat actors are planting bad code in open-source repositories in the hopes to harvest the flaws later when used in larger banking, manufacturing and healthcare Dev...

Intel® Driver & Support Assistant and Intel® Software Asset Manager Advisory

Summary: Potential security vulnerabilities in Intel® Driver & Support Assistant, Intel® Software Asset Manager and Intel® Computing Improvement Program may allow escalation of privilege. Intel is releasing Intel® Driver & Support Assistant updates to mitigate these potential vulnerabilities...

CVE-2003-1605

curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server...

MGASA-2018-0326 Updated mp3gain packages fix security vulnerabilities

A NULL pointer dereference was discovered in syncbuffer in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service CVE-2017-14406. A stack-based buffer over-read was discovered in...

CVE-2018-3056 vulnerabilities

Vulnerabilities for packages: mysql...

A week in security (July 9 – July 15)

Last week, we talked about domestic abuse fuelled by IoT, doing threat intel programs right, blocking ICO fraud, and man-in-the-middle attacks. We also explained why we block shady ad blockers and provided tips to online shoppers for Prime Day. Other news: Reports revealed that low-end Android...

Information disclosure

The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop Language Packs contain multiple...