9257 matches found
Fedora 29 : php (2019-da36d5d484)
PHP version 7.2.17 04 Apr 2019 Core: - Fixed bug php77738 Nullptr deref in zendcompileexpr. Laruence - Fixed bug php77660 Segmentation fault on break 2147483648. Laruence - Fixed bug php77652 Anonymous classes can lose their interface information. Nikita - Fixed bug php77676 Unable to run tests...
. NET advanced code audit of the seven classes NetDataContractSerializer deserializing vulnerability-vulnerability warning-the black bar safety net
NetDataContractSerializer and DataContractSerializer for serialization and de-serialization in Windows Communication Foundation WCF message to send the data. Between the two there is an important difference: the NetDataContractSerializer includes CLR through the CLR type to add additional...
Slack: Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijack
Affects: Janus DTLS certificate Description The Janus server in use by Slack is configured using a certificate and private key that were previously distributed by default. This certificate is used to authenticate the DTLS connection which is later used to exchange keys for the SRTP stream. As a...
Not just for Processing: How Kafka Streams as a Distributed Database Boosted our Reliability and Reduced Maintenance
The Apache Kafka Streams library is used by enterprises around the world to perform distributed stream processing on top of Apache Kafka. One aspect of this framework that is less talked about is its ability to store local state, derived from stream processing. In this blog post we describe how w...
DEBIAN-CVE-2019-8956
In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctpsendmsg" function net/sctp/socket.c when handling SCTPSENDALL flag can be exploited to corrupt memory...
Drupal Core stream wrapper Insecure Deserialization (CVE-2019-6339)
An insecure deserialization vulnerability exists in Drupal Core. The vulnerability is in a stream wrapper when performing file operations. Successful exploitation of this vulnerability could result in arbitrary code execution under the security context of the web server...
PT-2019-11963
Name of the Vulnerable Software and Affected Versions Robocode versions prior to 1.9.3.6 Description The issue allows remote attackers to cause external service interaction, specifically DNS queries, by leveraging a .openStream call within java.net.URL. This can be demonstrated by a query for a...
MGASA-2019-0121 Updated live, mplayer, vlc packages fix security vulnerability
The updated live, mplayer, vlc packages fix security vulnerabilities: liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash Segmentation fault...
The vulnerability in the implementation of the SCTP protocol in Linux kernel allows a attacker to cause a service failure or increase their privileges.
The vulnerability of the SCTP protocol implementation in Linux operating systems relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure or increase their privileges...
openSUSE Security Update : prosody (openSUSE-2019-414)
This update for prosody to version 0.10.2 fixes the following issues : This security issue was fixed : - CVE-2018-10847: Prevent insufficient validation of client-provided parameters during XMPP stream restarts. Authenticated users may have overriden the realm associated with their session,...
[20190502] - Core - By-passing protection of Phar Stream Wrapper Interceptor
In Joomla 3.9.3, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the Joomla core. In order to intercept file invocations like fileexists or stat on compromised Phar archives the base name has to be determined and...
openSUSE Security Update : MozillaThunderbird (openSUSE-2019-772)
This update for MozillaThunderbird fixes the following issues : Thunderbird 63 ESR was updated to version 60.3.0 to fix the following issues bsc1112852 : Security issues fixed MFSA 2018-28 : - CVE-2018-12389: Fixed memory safety bugs. - CVE-2018-12390: Fixed memory safety bugs. - CVE-2018-12391:...
kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service
An error in the "sctpmakechunk" function net/sctp/smmakechunk.c when handling SCTP, packet length can be exploited by a malicious local user to cause a kernel crash and a DoS...
CVE-2019-10021
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nComps...
CVE-2019-10025
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nBits...
UBUNTU-CVE-2019-10025
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nBits...
Xpdf PE Vulnerability (CNVD-2019-22438)
Xpdf is a free PDF viewer and toolkit that includes a text extractor, image converter, HTML converter and more. An FPE vulnerability exists in the ImageStream::ImageStream function in Stream.cc in Xpdf 4.01.01. No detailed vulnerability details are provided at this time...
UBUNTU-CVE-2019-10021
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nComps...
