yum-utils security update

1.1.31-46.0.1 - needs-restarting not checking kernel-uek for reboot message Orabug 27189714 - add bug27596617.patch to remove upstream URL reference 1.1.31-46 - reposync: prevent path traversal. - Resolves: bug1600617...

yum-utils security update

1.1.30-42.0.1 - add dependency btrfs-progs for yum-plugin-fs-snapshot [email protected] bug 16285176 - use unified btrfs binary instead of btrfsctl [email protected] bug 16285176 -1.1.30-42 - reposync: prevent path traversal. - Resolves: bug1600619...

Bento4 Buffer Overflow Vulnerability (CNVD-2018-14698)

Bento4 is an open source C++ library for reading and writing MP4 files. A heap buffer overflow vulnerability exists in AP4BytesToUInt16BE in the Core/Ap4Utils.h file in Bento4 version 1.5.1-624. An attacker can exploit this vulnerability to cause a heap buffer out-of-bounds read...

django_make_app is vulnerable to Code Injection

An exploitable vulnerability exists in the YAML parsing functionality in the readyamlfile method in ioutils.py in djangomakeapp 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability...

GHSA-CWH5-3CW7-4286 tlslite-ng off-by-one error on mac checking

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line endpos = datalen - 1 - mac.digestsize that can...

tlslite-ng off-by-one error on mac checking

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line endpos = datalen - 1 - mac.digestsize that can...

EulerOS 2.0 SP3 : shadow-utils (EulerOS-SA-2018-1169)

According to the version of the shadow-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A buffer overflow flaw leading to heap memory corruption was found in the shadow-utils's newusers utility. A local, authenticated attacker cou...

MGASA-2018-0289 Updated xdg-utils package fixes security vulnerability

Updated xdg-utils package fixes security vulnerability: The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via ...

Updated xdg-utils package fixes security vulnerability

Updated xdg-utils package fixes security vulnerability: The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via ...

Security Bulletin: A vulnerability in powerpc-utils-python affects PowerKVM (CVE-2014-8165)

Summary PowerKVM is affected by a vulnerability in powerpc-utils-python. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2014-8165 DESCRIPTION: powerpc-utils-python could allow a remote attacker to execute arbitrary code on the system, caused by the improper use of the...

Security Bulletin: PowerKVM is affected by ppc64-diag and powerpc-utils vulnerabilities (Multiple CVEs)

Summary PowerKVM is affected by multiple vulnerabilities in ppc64-diag and powerpc-utils. Vulnerability Details CVEID: CVE-2014-4038 DESCRIPTION: ppc64-diag could allow a local attacker to launch a symlink attack. lpdelatest.sh creates temporary files insecurely. A local attacker could exploit th...

Fedora Update for shadow-utils FEDORA-2018-35254ad97d

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for xdg-utils (important)

This update for xdg-utils fixes this security issues: - CVE-2017-18266: The openenvvar function in xdg-open did not validate strings launching the program specified by the BROWSER environment variable, which might allowed remote attackers to conduct argument-injection attacks via a crafted URL...

openSUSE Security Update : xdg-utils (openSUSE-2018-573)

This update for xdg-utils fixes this security issues : - CVE-2017-18266: The openenvvar function in xdg-open did not validate strings launching the program specified by the BROWSER environment variable, which might allowed remote attackers to conduct argument-injection attacks via a crafted URL...

[SECURITY] Fedora 28 Update: shadow-utils-4.6-1.fc28

The shadow-utils package includes the necessary programs for converting UNIX password files to the shadow password format, plus programs for managing user and group accounts. The pwconv command converts passwords to the shadow password format. The pwunconv command unconverts shadow passwords and...

SUSE-SU-2018:1497-1 Security update for xdg-utils

This update for xdg-utils fixes the following issues: Security issue: - CVE-2017-18266: Fix an argument injection when BROWSER contains %s bsc1093086...

Remote code execution

closure-utils is Utilities for Closure Library based projects. closure-utils downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the...

CVE-2016-10583

closure-utils is Utilities for Closure Library based projects. closure-utils downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the...

CVE-2016-10583

closure-utils is Utilities for Closure Library based projects. closure-utils downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the...

CVE-2016-10583

Affected software: closure-util / closure-utils. Issue: downloads binary resources over HTTP, enabling a man-in-the-middle (MitM) where an attacker in a privileged network position can intercept and replace the binary, potentially leading to remote code execution (RCE). Impact (as stated): code e...