Debian DSA-4374-1 : qtbase-opensource-src - security update

Several issues were discovered in qtbase-opensource-src, a cross-platform C++ application framework, which could lead to denial-of-service via application crash. Additionally, this update fixes a problem affecting vlc, where it would start without a GUI. C Tenable Network Security, Inc. The...

[SECURITY] [DSA 4374-1] qtbase-opensource-src security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4374-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 28, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4374-1] qtbase-opensource-src security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4374-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 28, 2019 https://www.debian.org/security/faq -...

DSA-4374-1 qtbase-opensource-src - security update

Bulletin has no description...

Debian: Security Advisory (DSA-4374-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PhpSpreadsheet 1.5.0 XXE vulnerability reproduction and analysis-vulnerability warning-the black bar safety net

0x01 introduction PhpSpreadsheet is a very popular pure PHP class library that allows you to easily read and write Excel, LibreOffic Calc and other spreadsheet file formats, is PHPExcel alternative. 2018 11 October 13, PhpSpreadsheet was broke presence of the XXE vulnerability, CVE-2018-19277, in...

WS-2019-0572

Openthread in versions thread-reference-20180619 to thread-reference-20180926is vulnerable to Stack-buffer-overflow in ot::Cli::Interpreter::ProcessService, related to src/cli/cli.cpp...

CVE-2019-1003003

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g...

WS-2019-0550

openthread in versionsthread-reference-20170716 to thread-reference-20180926 is vulnerable to Stack-buffer-overflow, related to src/core/thread/networkdatalocal.cpp...

WS-2019-0577

ReadStat in versions 0.1.0 to 0.1.1 is vulnerable to Stack-buffer-overflow in readstatconvert, related to src/readstatconvert.c...

PT-2019-7239

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 8.60 Description The issue allows for Stored XSS attacks through the use of a malformed "" character in the body of an e-mail message. Recommendations For MailEnable versions prior to 8.60, update to version 8.60 o...

Remote Code Execution (RCE)

github.com/src-d/go-git is vulnerable to remote code execution RCE attacks. A malicious user can pass a .gitmodules file to the application to cause arbitrary code to be executed on a target machine that runs the git clone --recurse-submodules command. This is related to CVE-2018-11235...

WS-2019-0574

Openthread in versions thread-reference-20180619 to thread-reference-20200818 is vulnerable to Stack-buffer-overflow in ot::IsValid, related to src/core/meshcop/dataset.cpp...

CVE-2018-1000407

A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins...

CVE-2018-1000407: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins...

Debian: Security Advisory (DLA-1627-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-1000631: Improper Neutralization of Special Elements used in an SQL Command

Battelle V2I Hub 3.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the tmx/TmxCtl/src/lib/PluginStatus.cpp and TmxControl::userinfo function, which could allow the attacker to view, add, modify or delete information in the back-end database...

Medium: python34, python36

Issue Overview: Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data...

WS-2018-0667

Harfbuzz in versions 1.7.0 to 2.2.0 is vulnerable to Crash in Stack-buffer-overflow in hbbsearchr, related to src/hb-ot-post-table.hh...

CVE-2018-5801: NULL Pointer Dereference

An error within the "LibRaw::unpack" function src/librawcxx.cpp in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference...