pixiv: RCE due to ImageTragick v2

Hello Pixiv team! Your Image processing process suffering from ImageTragick v2. Issue is caused by ghostscript RCE findnings. How to reproduce: PATCH /design Host: manage.booth.pm send following image: ------WebKitFormBoundaryXX05yrKS4g8d9CWh Content-Disposition: form-data; name="shopheader";...

CVE-2018-15594

arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests...

Code injection

arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests...

CVE-2018-15594

arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests...

DEBIAN-CVE-2018-15594

arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests...

CVE-2018-15594

arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests...

CVE-2018-15594

CVE-2018-15594 affects the Linux kernel arch/x86/paravirt.c, where mishandling of certain indirect calls weakens Spectre-v2 mitigations for paravirtual guests. The issue is addressed in kernel updates up to 4.18.1 (ChangeLog-4.18.1, commit 5800dc5c…). In practice, vulnerable systems running affec...

CVE-2018-15594

arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests...

CVE-2018-15594

arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests...

DEBIAN-CVE-2018-15572

The spectrev2selectmitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks...

CVE-2018-15594

arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests...

PT-2018-3624

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.18.1 Description The issue is related to the mishandling of certain indirect calls in the arch/x86/kernel/paravirt.c file, making it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests...

CVE-2018-15594: Exposure of Sensitive Information to an Unauthorized Actor

arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests...

CVE-2018-15469

An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest can still request v2 grant tables; they will simply not be properly set up, resulting in subsequent grant-related hypercalls hitting BUG...

CVE-2018-15469

CVE-2018-15469 affects Xen 4.11.x and earlier where ARM grant table v2 is not properly implemented in the hypervisor or Linux. An unprivileged ARM guest can request v2 grant tables that are not correctly set up, causing grant-related hypercalls to trigger a BUG() and crash the hypervisor, i.e., D...

CVE-2018-15469: Uncontrolled Resource Consumption

An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest can still request v2 grant tables; they will simply not be properly set up, resulting in subsequent grant-related hypercalls hitting BUG...

HPE 1810-24G Switch, 1810-48G Switch and 1810-8 v2 Switch Information Disclosure Vulnerability

The HPE 1810-24G Switch, 1810-48G Switch, and 1810-8 v2 Switch are all switch products from Hewlett Packard Enterprise HPE. An information disclosure vulnerability exists in HP 1810-24G Switch P.2.22 and earlier, 1810-48G Switch PK.1.34 and earlier, and 1810-8 v2 Switch P.2.22 and earlier, which...

PT-2018-13037

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.12 Description An issue in Xen allows an unprivileged guest to cause a denial-of-service crash in the hypervisor. This occurs because ARM never properly implemented grant table v2, either in the hypervisor or in Linux,...

CVE-2018-10569

Edimax EW-7438RPn Mini v2 is affected by a Cross‑Site Scripting (XSS) vulnerability in the SSID field prior to version 1.26. The issue is triggered via the SSID and can enable phishing-like misuse, with network access as the attack surface. A fix is available in version 1.26 or later; update to m...

CVE-2018-10569: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26. There is XSS in an SSID field...