PT-2017-14615

Name of the Vulnerable Software and Affected Versions filp whoops versions prior to 2.1.13 Description The issue is related to a Cross-site Scripting vulnerability in the dump function located in Util/TemplateHelper.php. This vulnerability can be exploited to execute malicious scripts...

CVE-2017-16872: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in Teluu pjproject pjlib and pjlib-util in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message like cseq, ttl, port, etc. all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted bac...

CVE-2017-16880: Improper Neutralization of Input During Web Page Generation

The dump function in Util/TemplateHelper.php in filp whoops before 2.1.13 has XSS...

client: unchecked deserialization in marshaller util

The hotrod java client in infinispan automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks...

Fedora 26 : apr-util (2017-329e5fb4c9)

Security fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

keycloak: SAML request parser replaces special strings with system properties

It was found that while parsing the SAML messages the StaxParserUtil class of Picketlink replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID fie...

[SECURITY] [DLA 1163-1] apr-util security update

Package : apr-util Version : 1.4.1-3+deb7u1 CVE ID : CVE-2017-12618 Debian Bug : 879996 It was discovered that there was an out-of-bounds read access in apr-util, a support/portability library used by many applications. A local user with write access to the database could have made a process usin...

DLA-1163-1 apr-util - security update

Bulletin has no description...

[ASA-201710-33] apr-util: denial of service

Arch Linux Security Advisory ASA-201710-33 ========================================== Severity: Low Date : 2017-10-27 CVE-ID : CVE-2017-12618 Package : apr-util Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-468 Summary ======= The package apr-util before version...

CVE-2017-12618

Apache Portable Runtime Utility APR-util 1.6.0 and prior fail to validate the integrity of SDBM database files used by aprsdbm functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and...

CVE-2017-12618

Apache Portable Runtime Utility APR-util 1.6.0 and prior fail to validate the integrity of SDBM database files used by aprsdbm functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and...

Out-of-bounds

Apache Portable Runtime Utility APR-util 1.6.0 and prior fail to validate the integrity of SDBM database files used by aprsdbm functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and...

CVE-2017-12618

Apache Portable Runtime Utility APR-util 1.6.0 and prior fail to validate the integrity of SDBM database files used by aprsdbm functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and...

CVE-2017-12618

Apache Portable Runtime Utility APR-util 1.6.0 and prior fail to validate the integrity of SDBM database files used by aprsdbm functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and...

CVE-2017-12618

CVE-2017-12618 affects APR-util (SDBM-backed databases used by apr_sdbm*()). The issue is a lack of integrity validation for SDBM files, enabling local attackers with write access to crash a program or cause denial of service. A patch/update for APR-util is available (see ALAS-2017-929 and Fedora...

CVE-2017-12618

Apache Portable Runtime Utility APR-util 1.6.0 and prior fail to validate the integrity of SDBM database files used by aprsdbm functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and...

PT-2017-12603

Name of the Vulnerable Software and Affected Versions Apache Portable Runtime Utility APR-util versions 1.6.0 and prior Description The issue is related to the failure to validate the integrity of SDBM database files used by apr sdbm functions, which can result in a possible out of bound read...

CVE-2017-12618: Out-of-bounds Read

Apache Portable Runtime Utility APR-util 1.6.0 and prior fail to validate the integrity of SDBM database files used by aprsdbm functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and...

PJSIP Teluu pjproject pjlib and pjlib-util Integer Overflow Vulnerability

PJSIP is an open source, free multimedia communication library written in C. Teluu pjproject pjlib is one of the small framework libraries; pjlib-util is one of the auxiliary tool libraries . An integer overflow vulnerability exists in Teluu pjproject pjlib and pjlib-util in versions of PJSIP pri...

Open vSwitch Denial of Service Vulnerability (CNVD-2017-32356)

Open vSwitch OvS is a multi-layer virtual switch product based on open source technology following the Apache 2.0 license that supports large-scale network automation through programmatic extensions, standard management interfaces and protocols, and more. A security vulnerability exists in the...