Microsoft Issues Emergency Fix for IE Zero Day

Microsoft today released an emergency software patch to plug a critical security hole in its Internet Explorer IE Web browser that attackers are already using to break into Windows computers. The software giant said it learned about the weakness CVE-2018-8653 after receiving a report from Google...

SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2018:4185-1)

This update for qemu fixes the following issues : Security issues fixed : CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use...

Advantech WebAccess/SCADA

1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: WebAccess/SCADA Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a stack buffer overflow condition. 3...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:4154-1)

This update for the Linux Kernel 3.12.74-6064104 fixes one issue. The following security issue was fixed : CVE-2018-9568: Prevent possible memory corruption due to type confusion in skclonelock. This could lead to local privilege escalation bsc1118319. Note that Tenable Network Security has...

Debian DLA-1605-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or bypass of the same-origin policy. For Debian 8 'Jessie', these problems have been fixed in version 60.4.0esr-1deb8u1. We recommend that you upgrade you...

AIX 7.1 TL 4 : solaris (IJ10275)

https://vulners.com/cve/CVE-2017-3623 https://vulners.com/cve/CVE-2017-3623 An unspecified vulnerability in Oracle Sun Systems related to the Solaris Kernel RPC component could allow an unauthenticated attacker to take control of the system. C Tenable Network Security, Inc. The text in the...

AIX 7.1 TL 5 : solaris (IJ10132)

https://vulners.com/cve/CVE-2017-3623 https://vulners.com/cve/CVE-2017-3623 An unspecified vulnerability in Oracle Sun Systems related to the Solaris Kernel RPC component could allow an unauthenticated attacker to take control of the system. C Tenable Network Security, Inc. The text in the...

Ubuntu 14.04 LTS : pixman vulnerability (USN-3843-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3843-1 advisory. It was discovered that pixman incorrectly handled the generalcompositerect function. A remote attacker could use this issue to cause pixman to crash, resulting in...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : CUPS vulnerability (USN-3842-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3842-1 advisory. Jann Horn discovered that CUPS incorrectly handled session cookie randomness. A remote attacker could possibly use this issue to perform...

SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2018:4064-1)

java-180-ibm was updated to Java 8.0 Service Refresh 5 Fix Pack 25 bsc1116574 Class Libraries : - IJ10934 CVE-2018-13785 - IJ10935 CVE-2018-3136 - IJ10895 CVE-2018-3139 - IJ10932 CVE-2018-3149 - IJ10894 CVE-2018-3180 - IJ10930 CVE-2018-3183 - IJ10933 CVE-2018-3214 - IJ09315 FLOATING POINT EXCEPTI...

SUSE SLED12 / SLES12 Security Update : opensc (SUSE-SU-2018:3622-2)

This update for opensc fixes the following issues : CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card bsc1106998 CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card bsc1106999 CVE-2018-16393: Fixed buffer overflows when handling...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : lxml vulnerability (USN-3841-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3841-1 advisory. It was discovered that lxml incorrectly handled certain HTML files. An attacker could possibly use this issue to conduct cross-site...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : OpenSSL vulnerabilities (USN-3840-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3840-1 advisory. Samuel Weiser discovered that OpenSSL incorrectly handled DSA signing. An attacker could possibly use this issue to perform a...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : LibRaw vulnerabilities (USN-3838-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3838-1 advisory. It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a...

Debian DLA-1603-1 : suricata security update

Several issues were found in suricata, an intrusion detection and prevention tool. CVE-2017-7177 Suricata has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching. CVE-2017-15377 It was possible to trigger lots of redundant checks on the...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : poppler vulnerabilities (USN-3837-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3837-1 advisory. It was discovered that poppler incorrectly handled certain PDF files. An attacker could possibly use this issue to cause a denial...

NUUO NVRMini2 3.9.1 - (Authenticated) Command Injection

NUUO NVRMini2 3.9.1 - Authenticated Command Injection Exploit Title: NUUO NVRMini2 Authenticated Command Injection Date: December 3, 2018 Exploit Author: Artem Metla Vendor Homepage: https://www.nuuo.com/ProductNode.php?node=2 Version: 3.9.1 Tested on: NUUO NVRMini2 with firmware 3.9.1 CVE :...

NUUO NVRMini2 3.9.1 - Authenticated Command Injection Exploit

Exploit for php platform in category web applications Exploit Title: NUUO NVRMini2 Authenticated Command Injection Exploit Author: Artem Metla Vendor Homepage: https://www.nuuo.com/ProductNode.php?node=2 Version: 3.9.1 Tested on: NUUO NVRMini2 with firmware 3.9.1 CVE : CVE-2018-15716 Advisory:...

SUSE SLED12 / SLES12 Security Update : ncurses (SUSE-SU-2018:3967-1)

This update for ncurses fixes the following issue : Security issue fixed : CVE-2018-19211: Fixed denial of service issue that was triggered by a NULL pointer dereference at function ncparseentry bsc1115929. Note that Tenable Network Security has extracted the preceding description block directly...

Ubuntu 18.10 : linux, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities (USN-3835-1)

Jann Horn discovered that the procfs file system implementation in the Linux kernel did not properly restrict the ability to inspect the kernel stack of an arbitrary task. A local attacker could use this to expose sensitive information. CVE-2018-17972 Jann Horn discovered that the mremap system...