Security Advisory - Integer Overflow Vulnerability on Smartphones

There is an integer overflow vulnerability on smartphones. The software does not process certain variable properly when handle certain process. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could cause information disclosure. Vulnerability...

Security Advisory - Arbitrary Lock Pattern Change Vulnerability in Huawei HiWallet APP

Huawei HiWallet App has an arbitrary lock pattern change vulnerability. It needs to verify the user's Huawei ID during lock pattern change. An attacker with root privilege who gets a user's smart phone may bypass Huawei ID verification by special operation. Successful exploit of this vulnerabilit...

SUSE-SU-2017:3369-1 Security update for java-1_6_0-ibm

This update for java-160-ibm fixes the following issues: Security issues fixed: - Security update to version 6.0.16.50 bsc1070162 CVE-2017-10346 CVE-2017-10285 CVE-2017-10388 CVE-2017-10356 CVE-2017-10293 CVE-2016-9841 CVE-2017-10355 CVE-2017-10357 CVE-2017-10348 CVE-2017-10349 CVE-2017-10347...

Multiple vulnerabilities in H2O

Overview H2O is an open source web server software. H2O contains multiple vulnerabilities listed below. A Denial-of-service DoS due to a flaw in processing HTTP/1 header CWE-20 - CVE-2017-10868 Stack-based buffer overflow CWE-121 - CVE-2017-10869 A Denial-of-service DoS due to a flaw in outputtin...

DSA-4066-1 otrs2 - security update

Bulletin has no description...

MGASA-2017-0450 Updated evince packages fix security vulnerability

It was discovered that Evince incorrectly handled printing certain DVI files. If a user were tricked into opening and printing a specially-named DVI file, an attacker could use this issue to execute arbitrary code CVE-2017-1000159...

Microsoft Internet Explorer and Edge CVE-2017-11894 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue to execute arbitrary code in the context of the currentl...

Leftover Debugger Doubles as a Keylogger on Hundreds of HP Laptop Models

HP Inc. released a software update to fix a vulnerability that allows attackers to turn debugging code, accidentally left on hundreds of model laptops, into a keylogger. Researcher Michael Myng is credited for discovering the vulnerability tied to the use of a Synaptics Touchpad driver. He said i...

DLA-1202-1 firefox-esr - security update

Bulletin has no description...

DLA-1200-1 linux - security update

Bulletin has no description...

MGASA-2017-0445 Updated wireshark packages fix security vulnerability

The wireshark package has been updated to version 2.2.11, which fixes a few security issues where a malformed packet trace could cause it to crash, and fixes several other bugs as well. See the release notes for details...

PT-2017-14301

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions prior to 6.1.19 Palo Alto Networks PAN-OS versions 7.0.x prior to 7.0.19 Palo Alto Networks PAN-OS versions 7.1.x prior to 7.1.14 Palo Alto Networks PAN-OS versions 8.0.x prior to 8.0.6 Description The issue...

Security Advisory - DoS Vulnerability in Some Huawei Products

There is an DoS vulnerability in some Huawei products due to insufficient validation of the parameter when a putty comment key is loaded. An authenticated remote attacker can place a malformed putty key file in system, when a system manager load the key, an infinite loop happens which lead to...

Security Advisory - Memory Leak Vulnerability in Several Huawei Products

There is a memory leak vulnerability in several Huawei products. The software does not release allocated memory properly when parse XML Schema data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory...

Security Advisory - Buffer Overflow Vulnerability in Some Huawei Products

There is a buffer overflow vulnerability in the Common Open Policy Service Protocol COPS module of some Huawei products. An unauthenticated, remote attacker could exploit this vulnerability by sending specially crafted message to the affected products. The vulnerability is due to insufficient inp...

OPENSUSE-SU-2017:3203-1 Security update for tor

This update for tor fixes vulnerabilities that allowed some traffic confirmation, DoS and other attacks bsc1070849: - CVE-2017-8819: Replay-cache ineffective for v2 onion services - CVE-2017-8820: Remote DoS attack against directory authorities - CVE-2017-8821: An attacker can make Tor ask for a...

MGASA-2017-0439 Updated perl-Catalyst-Plugin-Static-Simple package fixes security vulnerability

The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character CVE-2017-16248...

SUSE-SU-2017:3176-1 Security update for curl

This update for curl fixes the following security issues: - CVE-2017-1000254: FTP PWD response parser out of bounds read bsc1061876...

JVN#78501037: Movable Type plugin A-Member and A-Reserve vulnerable to SQL injection

A-Member and A-Reserve provided by ARK-Web co., ltd. are plugins for Movable Type which provide functions to build a membership website or a reservation website. A-Member and A-Reserve contain SQL injection CWE-89 vulnerability due to the issue in processing cookie values. Impact An attacker who...

StreamRelay.net.exe and sDNSProxy.exe vulnerable to denial-of-service (DoS)

Overview StreamRelay.net.exe and sDNSProxy.exe fail to properly process ICMP Port Unreachable message CWE-703. Tomoki Sanaki reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Tomoki Sanaki coordinated under the Information Security Early Warning...