Microsoft Patch Tuesday - August 2017

Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 48 new vulnerabilities with 25 of them rated critical, 21 rated important, and 2 rated moderate. These...

Windows Subsystem for Linux Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles NT pipes. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker could run a...

Windows Subsystem for Linux Denial of Service Vulnerability

A denial of service vulnerability exists when Windows Subsystem for Linux improperly handles objects in memory. An attacker who successfully exploited this vulnerability could cause a denial of service against the local system. A attacker could exploit this vulnerability by running a specially...

KB4034674: Windows 10 Version 1703 August 2017 Cumulative Update

The remote Windows host is missing security update 4034674. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists when Microsoft Windows improperly handles NetBIOS packets. An attacker who successfully exploited this vulnerability could cause a target...

KLA11087 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in...

CVE-2006-3635

The ia64 subsystem in the Linux kernel before 2.6.26 allows local users to cause a denial of service stack consumption and system crash via a crafted application that leverages the mishandling of invalid Register Stack Engine RSE state...

CVE-2006-3635

CVE-2006-3635 concerns the Linux kernel ia64 subsystem prior to 2.6.26. The vulnerability arises from mishandling of invalid Register Stack Engine (RSE) state, enabling a local attacker to trigger a denial of service through stack consumption, potentially crashing the system. The issue is limited...

Moderate: Red Hat Security Advisory: pki-core security update

An update for pki-core is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

USN-3364-3: Linux kernel (AWS, GKE) vulnerabilities

It was discovered that the Linux kernel did not properly initialize a Wake- on-Lan data structure. A local attacker could use this to expose sensitive information kernel memory. CVE-2014-9900 It was discovered that the Linux kernel did not properly restrict access to /proc/iomem. A local attacker...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3364-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3364-1 advisory. It was discovered that the Linux kernel did not properly initialize a Wake- on-Lan data structure. A local attacker could use this to expose sensitive...

USN-3364-2: Linux kernel (Xenial HWE) vulnerabilities

USN-3364-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that the Linux kernel did not properly initialize a Wake- on-Lan dat...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3360-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3360-1 advisory. It was discovered that the Linux kernel did not properly initialize a Wake- on-Lan data structure. A local attacker could use this to expose sensitive...

Ubuntu: Security Advisory (USN-3360-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3360-1: Linux kernel vulnerabilities

It was discovered that the Linux kernel did not properly initialize a Wake- on-Lan data structure. A local attacker could use this to expose sensitive information kernel memory. CVE-2014-9900 It was discovered that the Linux kernel did not properly restrict access to /proc/iomem. A local attacker...

Ubuntu 17.04 : linux, linux-raspi2 vulnerabilities (USN-3358-1)

It was discovered that the Linux kernel did not properly initialize a Wake- on-Lan data structure. A local attacker could use this to expose sensitive information kernel memory. CVE-2014-9900 Alexander Potapenko discovered a race condition in the Advanced Linux Sound Architecture ALSA subsystem i...

CVE-2017-6742

CVE-2017-6742 is a Cisco SNMP remote code execution vulnerability in the SNMP stack of IOS/IOS XE. A stack-based overflow could allow an authenticated attacker to run arbitrary code or cause a reload by sending crafted SNMP packets (targets SNMP v1/v2c/v3; needs read-only community string or v3 c...

CVE-2017-6736

The Simple Network Management Protocol SNMP subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these...

CVE-2017-6743

Cisco IOS and IOS XE SNMP Remote Code Execution Vulnerabilities (CVE-2017-6743) arise from buffer overflow in the SNMP subsystem, allowing an authenticated, remote attacker to execute arbitrary code or cause a reload by sending crafted SNMP packets over IPv4/IPv6. Exploitation varies by SNMP vers...

CVE-2017-6738

Cisco IOS and IOS XE SNMP subsystem contains multiple buffer overflow vulnerabilities that could allow an authenticated, remote attacker to execute arbitrary code or cause a reload via crafted SNMP packets over IPv4/IPv6. Affected are SNMP versions 1–3; for SNMPv2c/earlier, attacker needs the rea...

CVE-2017-6742

A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device. The vulnerability is due to a...