libvirt security and bug fix update

3.9.0-14.el75.6 - logging: Don't inhibit shutdown in system daemon rhbz1573268 - util: don't check for parallel iteration in hash-related functions rhbz1581364 - cpu: define the 'virt-ssbd' CPUID feature bit CVE-2018-3639 - virNumaGetHugePageInfo: Return pageavail and pagefree as ULL rhbz1582418...

Information Disclosure

jetty-util and jetty-servlet is vulnerable to information disclosures. When handling a query with bad characters that doesn't match the url-pattern, the application throws an InvalidPathException that shows the full path to the base resource directory of the web application...

Security Bulletin: A vulnerability in util-linux affects PowerKVM

Summary PowerKVM is affected by a vulnerability in util=linux. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-2616 DESCRIPTION: util-linux could allow a local authenticated attacker to bypass security restrictions, caused by a race condition when handling the...

Security Bulletin: A vulnerability in util-linux affects PowerKVM (CVE-2016-5011)

Summary PowerKVM is affected by a vulnerability in the util-linux package's libblkid library. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2016-5011 DESCRIPTION: Util-linux is vulnerable to a denial of service, caused by an error when parsing Master Boot Record MBR...

Security Bulletin: A vulnerability in nss-util affects PowerKVM (CVE-2016-1950)

Summary PowerKVM is affected by a vulnerability in nss-util. This vulnerability is now fixed. Vulnerability Details CVEID: CVE-2016-1950 DESCRIPTION: Mozilla Firefox is vulnerable to a heap-based buffer overflow, caused by improper bounds checking when the Network Security Services NSS libraries...

Security Bulletin: Multiple security vulnerabilities have been fixed in products bundled with IBM Security Directory Suite 8.0.1

Summary Multiple security vulnerabilities have been fixed in products bundled with IBM Security Directory Suite 8.0.1 Vulnerability Details CVEID: CVE-2015-8778 DESCRIPTION: GNU C Library glibc could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in...

Security Bulletin: IBM QRadar Network Security is affected by a vulnerability in coreutils (util-linux)

Summary A security vulnerability has been discovered in coreutils util-linux, which is used by IBM QRadar Network Security. Vulnerability Details CVEID: CVE-2017-2616 DESCRIPTION: util-linux could allow a local authenticated attacker to bypass security restrictions, caused by a race condition whe...

Security Bulletin: IBM Security Network Protection is affected by a vulnerability in coreutils (util-linux)

Summary A security vulnerability has been discovered in coreutils util-linux, which is used by IBM Security Network Protection. Vulnerability Details CVEID: CVE-2017-2616 DESCRIPTION: util-linux could allow a local authenticated attacker to bypass security restrictions, caused by a race condition...

Security Bulletin: IBM Security Access Manager for Web is affected by vulnerabilities in nss, nss-util, and nspr (CVE-2016-1978, CVE-2016-1979)

Summary Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. The nss-util packages provide utilities for use with the Network Security Services NSS libraries. Netscape Portable Runtime NSPR...

Security Bulletin: IBM Security Access Manager for Mobile is affected by vulnerabilities in nss, nss-util, and nspr (CVE-2016-1978, CVE-2016-1979)

Summary Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. The nss-util packages provide utilities for use with the Network Security Services NSS libraries. Netscape Portable Runtime NSPR...

Security Bulletin: Security Vulnerabilities in IBM HTTP Server (CVE-2017-9798, CVE-2017-12618)

Summary There is an information disclosure vulnerability and a denial of service vulnerability that affect the IBM HTTP Server used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-9798 DESCRIPTION: Apache HTTP Server could allow a remote attacker to obtain sensitive...

CVE-2018-9246

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

CVE-2018-9246

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

Code injection

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

CVE-2018-9246

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

CVE-2018-9246

The CVE-2018-9246 issue affects the PGObject::Util::DBAdmin Perl module prior to 0.120.0, used in LedgerSMB up to 1.5.x. It inadequately sanitizes/escapes variables used in shell commands, enabling shell code injection via create(), run_file(), backup(), or restore(). This allows an attacker to e...

CVE-2018-9246

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

CVE-2018-9246

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create, runfile, backup, or restore function. The vulnerability...

Cross site scripting

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

Libmobi Information Disclosure Vulnerability (CNVD-2018-10876)

Libmobi is a C-based language for processing Kindle MOBI format e-book document library . A security vulnerability exists in the 'mobigetkf8boundaryseqnumber' function in the util.c file in Libmobi version 0.3. A remote attacker can exploit this vulnerability to disclose information heap-based...