A week in security (August 26 – September 1)

Last week on Malwarebytes Labs, we analysed the Android xHelper trojan, we wondered why the Nextdoor app would send out letters on behalf of their customers, reported about a study that explores the clickjacking problem across top Alexa-ranked websites, wondered how to get the board to invest in...

In-depth analysis of the thread and process handle leak vulnerability, under-vulnerability warning-the black bar safety net

PROCESSVM It covers the VM access permissions three types: WRITE/READ/OPERATION. The first two permissions should be self-explanatory, the third permission allows the operation of the virtual address space itself, such as modifying the page protection VirtualProtectEx or allocating memory with...

NASA astronaut accused of accessing ex-wife’s bank account from space

By Waqas The US space agency NASA National Aeronautics and Space Administration has confirmed that it is currently investigating an incident involving one of its astronauts who might have committed the first-ever cyber crime in outer space. This is a post from HackRead.com Read the original post:...

Product update: Virtuozzo Infrastructure Platform 2.5 Update 10 (2.5.0-1691)

This update provides fixes and improvements. Vulnerability id: VSTOR-22386, VSTOR-24775, VSTOR-25752 Upgrade Improvements in iSCSI targets migration during upgrade. Vulnerability id: VSTOR-25072 Upgrade Improved upgrade speed. Vulnerability id: VSTOR-25784 Upgrade Unable to download upgrade as a...

UBUNTU-CVE-2019-13486

In Xymon through 4.3.28, a stack-based buffer overflow exists in the status-log viewer component because of expansion in svcstatus.c...

UBUNTU-CVE-2019-13455

In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the alert acknowledgment CGI tool because of expansion in acknowledge.c...

CVE-2019-4049

IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying filesystem using the error logging service. IBM X-Force ID: 156398...

Denial of service

IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying filesystem using the error logging service. IBM X-Force ID: 156398...

CVE-2019-4049

IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying filesystem using the error logging service. IBM X-Force ID: 156398...

CVE-2019-4049

CVE-2019-4049 affects IBM MQ 9.1.x (9.1.0.0, 9.1.0.1, 9.1.1, 9.1.0.2). The issue allows a local attacker to cause a denial of service by filling the underlying filesystem disk space via the error logging service. Root cause is in the error logging functionality. Remediation: IBM advises upgrading...

PT-2019-16863

Name of the Vulnerable Software and Affected Versions IBM MQ versions 9.1.0.0 through 9.1.1 Description The issue allows a local user to cause a denial of service by filling up the disk space of the underlying filesystem using the error logging service. Recommendations For IBM MQ versions 9.1.0.0...

Local File Disclosure via Word Export in Confluence Server - CVE-2019-3394

Confluence Server and Data Center had a local file disclosure vulnerability in the page export function. A remote attacker who has Add Page space permission would be able to read arbitrary files in the /confluence/WEB-INF/ directory and it's subdirectories, which may contain configuration files...

PT-2020-9646

Name of the Vulnerable Software and Affected Versions QEMU version 4.0.0 Description The issue is related to a buffer overflow in the PCIe extended config space due to insufficient PCI config space allocation in the hw/display/bochs-display.c file. Recommendations For QEMU version 4.0.0, at the...

Microsoft Windows XmlLite XML space Attribute Denial-Of-Service Vulnerability

This vulnerability allows remote attackers to produce a denial-of-service condition on affected installations of Microsoft Windows. Interaction with the XmlLite.dll library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw...

NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0007)

The remote NewStart CGSL host, running version MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - It was found that the timer functionality in the Linux kernel ALSA subsystem is prone to a race condition between read and ioctl system call handlers, resulting...

NewStart CGSL CORE 5.04 / MAIN 5.04 : ghostscript Multiple Vulnerabilities (NS-SA-2019-0054)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ghostscript packages installed that are affected by multiple vulnerabilities: - It was discovered that the ghostscript PDF14 compositor did not properly handle the copying of a device. An attacker could possibly exploit thi...

[SECURITY] Fedora 29 Update: hostapd-2.8-1.fc29

hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground a nd acts as the backe...

IBM MQ Input Validation Error Vulnerability

IBM MQ IBM WebSphere MQ is a messaging middleware product from IBM. The product is mainly for the service-oriented architecture SOA to provide a reliable and proven messaging backbone. An input validation error vulnerability exists in IBM MQ. An attacker could exploit this vulnerability to cause ...

poppler: memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc

An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo...

PT-2019-20248

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.1.20 Description A security issue exists where a malicious guest can cause the host to crash or monopolize all of the foreign/grant map pfn space, starving out other guests, by crafting requests to the backend...