[SECURITY] Fedora 32 Update: wireshark-3.2.7-1.fc32

Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless WiFi or Bluetooth networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. It has many powerful...

Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Impact A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a...

CVE-2019-18794

The BASS Audio Library 2.4.14 under Windows is prone to a BASSStreamCreateFile Use after Free vulnerability via a crafted .ogg file. An attacker can exploit this to gain access to sensitive information that may aid in further attacks. A failure in exploitation leads to denial of service...

CVE-2019-18795

The BASS Audio Library 2.4.14 under Windows is prone to a BASSStreamCreateFile out of bounds read vulnerability via a crafted .wav file. An attacker can exploit this issues to gain access to sensitive information that may aid in further attacks. A failure in exploitation leads to denial of servic...

Fix of 227 CVE

Fix bug 69720: Null pointer dereference in phargetfpoffset - Fix bug 70728: Type Confusion Vulnerability in PHPtoXMLRPCworker - Fix bug 70661: Use After Free Vulnerability in WDDX Packet Deserialization - Fix bug 70741: Session WDDX Packet Deserialization Type Confusion Vulnerability - Fix bug...

CLSA-2020-1605798462 Fix of 227 CVE

Fix bug 69720: Null pointer dereference in phargetfpoffset - Fix bug 70728: Type Confusion Vulnerability in PHPtoXMLRPCworker - Fix bug 70661: Use After Free Vulnerability in WDDX Packet Deserialization - Fix bug 70741: Session WDDX Packet Deserialization Type Confusion Vulnerability - Fix bug...

RUSTSEC-2020-0058 crate has been renamed to `cipher`

This crate has been renamed from stream-cipher to cipher. The new repository location is at:...

chromium-browser: Use after free in WebRTC

Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC stream...

SQL Injection Vulnerability in Lean Value Stream Management System (LVS) at Hangzhou Gila Technology Co.

Hangzhou Gila Technology Co., Ltd. is an enterprise network service provider, is committed to providing customized solutions based on the needs of the enterprise network, to create a cloud service cloud network platform. A SQL injection vulnerability exists in the Lean Value Stream Management...

Microsoft Windows Media Foundation H265 Stream Parsing Remote Code Execution (CVE-2020-16915)

A code execution vulnerability exists in Microsoft Windows Media Foundation. The vulnerability is due to improper validation of H265 media files. A remote attacker could exploit the vulnerability by enticing a victim user to open a maliciously crafted media file or open the folder containing the...

CVE-2020-26945

MyBatis before 3.5.6 mishandles deserialization of object streams...

qemu-kvm security update

1.5.3-175.el79.1 - Fixing release number for z-stream...

Denial Of Service (DoS)

freerdp is vulnerable to denial of service DoS. The attacker use stream pointer out of bounds in updaterecvsecondaryorder read later could lead crash the application...

Man-in-the-Middle (MitM)

twitter-stream is vulnerable to man-in-the-middle MitM. Lack of hostname validation allows an attacker to perform a man-in-the-middle attack to intercept and modify network traffic...

LY Corporation: Webview in LINE client for iOS will render application/octet-stream files as HTML

Due to misconfiguration in the webview of LINE client for iOS, the data with header "Content-type" as "application/octet-stream" was treated as HTML. This could lead to a malicious Javascript execution, resulting a Cross-site scripting attack...

DEBIAN-CVE-2020-6532

Use after free in SCTP in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Cross-site Scripting (XSS)

Activity Stream is vulnerable to cross-site scripting XSS. It can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Strea...

Integer overflow

An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to allocate memory for...

CVE-2020-6113

An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to allocate memory for...

Nitro Software Nitro Pro Input Validation Error Vulnerability (CNVD-2020-52634)

Nitro Software Nitro Pro is a U.S. Nitro Software PDF document editor software. The software supports PDF document editing, PDF document formatting and encryption of PDF documents and other functions. An input validation error vulnerability exists in Nitro Pro version 13.13.2.242, which stems fro...