PT-2018-7141 · Hawtio · Hawtio

Name of the Vulnerable Software and Affected Versions: hawtio versions prior to 1.5.5 Description: The issue allows for remote code execution via file upload. An attacker could upload a crafted file to be executed on a target machine where hawtio is deployed. Recommendations: For versions prior t...

PT-2018-10423 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.91 Description: The issue is related to a DOM-based XSS in the app/webroot/js/misp.js file, specifically with cortex type attributes. Recommendations: For MISP version 2.4.91, update to a newer version that contains a fix for...

MGASA-2018-0232 Updated qpdf packages fix security vulnerability

A flaw was found in QPDF through 8.0.2. libqpdf.a mishandles certain 'expected dictionary key but found non-name object' cases, allowing remote attackers to cause a denial of service stack exhaustion, related to the QPDFObjectHandle and QPDFDictionary classes CVE-2018-9918...

PT-2018-10083 · Abcm2Ps +3 · Abcm2Ps +3

Name of the Vulnerable Software and Affected Versions: abcm2ps versions 8.13.20 and earlier Description: The issue is a stack-based buffer overflow in the delayed output function in music.c that allows remote attackers to cause a denial of service, resulting in an application crash, or possibly...

Buffer Overflow in Lenovo System Update Drive Mapping Utility - Lenovo Support US

No description provided...

MGASA-2018-0213 Updated webkit2 packages fix security vulnerabilities

The webkit2 package has been updated to version 2.20.1, fixing several security issues and other bugs...

pfSense End of Life (EOL) Detection

The pfSense version on the remote host has reached the End of Life EOL and should not be used anymore. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

PT-2018-11345 · Spring · Spring Framework

Name of the Vulnerable Software and Affected Versions: Spring Framework versions 5.0 prior to 5.0.5 Spring Framework versions 4.3 prior to 4.3.15 Spring Framework older unsupported versions Description: The issue allows applications to configure Spring MVC to serve static resources. A malicious...

SUSE-SU-2018:0630-1 Security update for java-1_7_1-ibm

This update for java-171-ibm provides the following fix: The version was updated to 7.1.4.20 bsc1082810 Security fixes: - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677...

OPENSUSE-SU-2018:0629-1 Security update for go1.8

This update for go1.8 fixes the following issues: Security issues fixed: - CVE-2018-6574: 'go get' allows for remote command execution during source code build bsc1080006. Bug fixes: - bsc1082409: Review dependencies requires, recommends and supports This update was imported from the...

PT-2018-1903

Name of the Vulnerable Software and Affected Versions Django versions 2.0 before 2.0.3 Django versions 1.11 before 1.11.11 Django versions 1.8 before 1.8.19 Description The issue is related to a catastrophic backtracking vulnerability in a regular expression used by the django.utils.text.Truncato...

SUSE SLED12 Security Update : zziplib (SUSE-SU-2018:0548-1)

This update for zziplib fixes the following issues: Version update to 0.13.67 contains lots of bug- and security fixes. - If an extension block is too small to hold an extension, do not use the information therein. - CVE-2018-6540: If the End of central directory record EOCD contains an Offset of...

SUSE-SU-2018:0373-1 Security update for libjpeg-turbo

This update for libjpeg-turbo fixes the following issues: Feature update: - Update from version 1.3.1 to version 1.5.2 fate324061. Security issue fixed: - CVE-2017-15232: Fix NULL pointer dereference in jdpostct.c and jquant1.c bsc1062937...

JVN#15643848: Spring Security and Spring Framework vulnerable to authentication bypass

Spring Framework and Spring Security provided by Pivotal Software, Inc. contain an authentication bypass vulnerability. Impact A remote attacker can bypass authentication. As a result, the attacker gains access to the server and information may be disclosed. Solution Update the Software Update to...

MGASA-2018-0082 Updated webkit2 packages fix security vulnerabilities

The webkit2 package has been updated to version 2.18.5, containing Spectre mitigations...

SUSE-SU-2018:0065-1 Fixing security issues on OBS toolchain

This OBS toolchain update fixes the following issues: Package 'build': - CVE-2017-14804: Improve file name check extractbuild bsc1069904 - Fixed Dockerfile repository parsing Package 'obs-service-sourcevalidator': - CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec...

MGASA-2018-0066 Updated python-mistune packages fix security vulnerabilities

mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline such as in java\nscript: or a crafted email address, related to the escape and autolink functions CVE-2017-15612. A cross-site-scripting vulnerability was found in python-mistune CVE-2017-16876...

MGASA-2018-0008 Updated ffmpeg packages fix security vulnerability

This update provides ffmpeg version 2.4.14, which fixes several security vulnerabilities and other bugs which were corrected upstream...

MGASA-2018-0005 Updated webkit2 packages fix security vulnerabilities

The webkit2 package has been updated to version 2.18.4, fixing several security issues and other bugs...

GHSA-H9MJ-FGHC-664W Denial of Service in mqtt

Affected versions of mqtt do not properly handle PUBLISH packets returning from the server, leading to a Denial of Service condition. The vulnerability is completely mitigated if the only connected servers are trusted, guaranteed not to be under the control of a malicious actor. Proof of Concept...