DEBIAN-CVE-2017-15022

dwarf2.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29, does not validate the DWATname data type, which allows remote attackers to cause a denial of service bfdhashhash NULL pointer dereference, or out-of-bounds access, and application crash via a craft...

DEBIAN-CVE-2017-1000112

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSGMORE ipappenddata calls ipufoappenddata to append. However in between two send calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In...

UBUNTU-CVE-2017-15022

dwarf2.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29, does not validate the DWATname data type, which allows remote attackers to cause a denial of service bfdhashhash NULL pointer dereference, or out-of-bounds access, and application crash via a craft...

BitCracker - BitLocker Password Cracking Tool (Windows Encryption Tool)

BitLocker is a full-disk encryption feature available in recent Windows versions Vista, 7, 8.1 and 10 Pro and Enterprise. BitCracker is a mono-GPU password cracking tool for memory units encrypted with the password authentication mode of BitLocker see picture below. Our attack has been tested on...

UBUNTU-CVE-2017-14934

processdebuginfo in dwarf.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service infinite loop via a crafted ELF file that contains a negative size value in a CU structure...

Serial port access without authentication vulnerability in Huawei B2338-168 CPE device outdoor unit

The Huawei B2338-168 is a wireless terminal device from Huawei, China, capable of receiving WiFi signals. outdoor unit is one of the units used for sending and receiving signals. An unauthenticated serial port access vulnerability exists in the outdoor unit of the Huawei B2338-168 CPE device. An...

Port access without authentication vulnerability in Huawei B2338-168 CPE device outdoor unit

The Huawei B2338-168 is a wireless terminal device from Huawei, China, capable of receiving WiFi signals. outdoor unit is one of the units used for sending and receiving signals. A port access without authentication vulnerability exists in the outdoor unit of the Huawei B2338-168 CPE device. Afte...

'HoeflerText' Popups Target Browsers With RAT and Locky Ransomware

A malware campaign utilizing bogus popups that alert users to a missing web-font is targeting Google Chrome and Firefox browser users. The popups contain a malicious JavaScript file that initiates the download of either the NetSupport Manager remote access tool RAT or Locky ransomware. The...

CVE-2015-8334

SQL injection vulnerability in the Operation and Maintenance Unit OMU in Huawei VCN500 before V100R002C00SPC201 allows remote authenticated users to execute arbitrary SQL commands via a crafted HTTP request...

Updated dbus packages fix security vulnerabilities

A format string vulnerability in the reference bus implementation, dbus-daemon, could potentially allow local users to cause arbitrary code execution or denial of service. Symlink attack in nonce-tcp transport bsc1025950. Symlink attack in unit tests bsc1025951...

CVE-2017-9647

A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 PMB 8876 chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015...

CVE-2017-6763

A vulnerability in the implementation of the H.264 protocol in Cisco Meeting Server CMS 2.1.4 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected system. The vulnerability exists because the affected application does not properly validate...

Design/Logic Flaw

A vulnerability in the implementation of the H.264 protocol in Cisco Meeting Server CMS 2.1.4 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected system. The vulnerability exists because the affected application does not properly validate...

tigervnc and fltk security, bug fix, and enhancement update

fltk 1.3.4-1 - Re-base to 1.3.4 + sync with Fedora tigervnc 1.8.0-1 - Update to 1.8.0 Resolves: bz1388620 1.7.90-2 - Make RandR callbacks optional Resolves: bz1444948 1.7.90-1 - Update to 1.7.90 Resolves: bz1388620 1.7.1-3 - Delete underlying ssecurity in SSecurityVeNCrypt CCVE-2017-7392 Resolves...

PT-2017-19088 · Infineon · Infineon S-Gold 2

Name of the Vulnerable Software and Affected Versions: Infineon S-Gold 2 PMB 8876 chipset versions used in various vehicle models produced between 2009-2016 Description: An issue with improper restriction of operations within the bounds of a memory buffer was found. This issue may allow an attack...

GStreamer security, bug fix, and enhancement update

clutter-gst2 2.0.18-1 - Update to 2.0.18 - Remove obsolete patches - Use license macro for COPYING - Resolves: 1386833 gnome-video-effects 0.4.3-1 - Update to 0.4.3 - Resolves: 1386968 0.4.1-5 - Fix URL rhbz1380981 gstreamer-plugins-bad-free 0.10.23-23 - Rebuild with hardened flags Resolves:...

Cisco Meeting Server Denial of Service Vulnerability (CNVD-2017-20383)

Cisco Meeting Server formerly known as Acano Conferencing Server, CMS is the United States Cisco Cisco company's set of audio and video conferencing server software. A denial of service vulnerability exists in the implementation of the H.264 protocol in CMS, which stems from the program failing t...

SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2017:2031-1)

This update for systemd provides several fixes and enhancements. Security issues fixed : - CVE-2017-9217: NULL pointer dereferencing that could lead to resolved aborting. bsc1040614 - CVE-2017-9445: Possible out-of-bounds write triggered by a specially crafted TCP payload from a DNS server...

Continental TCU Stack Buffer Overflow Vulnerability

The TCU is a 2G modem commonly used in modern automobiles manufactured by Continental AG for transmitting data that enables communication between the car and remote management tools such as web panels and mobile applications. A stack buffer overflow vulnerability in the Continental TCU affects TC...

Cisco Meeting Server H.264 Protocol Denial of Service Vulnerability

A vulnerability in the implementation of the H.264 protocol in Cisco Meeting Server CMS could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected system. The vulnerability exists because the affected application does not properly validate...