SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2019:1574-1)

"This update for samba fixes the following issues : Security issues fixed : CVE-2019-12435: zone operations can crash rpc server; bso13922 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SUSE update advisory SUSE-SU-2019:1574-1. The text...

Denial Of Service (DoS)

The kernel packages contain the Linux kernel, the core of any Linux operating system. A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol SCTP implementation handled simultaneous connections between the same hosts. A remote attacker could u...

SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2019:1037-1)

This update for samba fixes the following issues : Security issue fixed : CVE-2019-3880: Fixed a path/symlink traversal vulnerability, which allowed an unprivileged user to save registry files outside a share bsc1131060. Non-security issues fixed: Fix vfsceph ftruncate and fallocate handling...

SUSE-SU-2019:1037-1 Security update for samba

This update for samba fixes the following issues: Security issue fixed: - CVE-2019-3880: Fixed a path/symlink traversal vulnerability, which allowed an unprivileged user to save registry files outside a share bsc1131060. Non-security issues fixed: - Fix vfsceph ftruncate and fallocate handling...

Unbreakable Enterprise kernel security update

2.6.39-400.307.1 - proc: restrict kernel stack dumps to root John Donnelly Orabug: 29114880 CVE-2018-17972 - alarmtimer: Prevent overflow for relative nanosleep Thomas Gleixner Orabug: 29269182 CVE-2018-13053 - ext4: only look at the bgflags field if it is valid Theodore Ts'o Orabug: 29409428...

The vulnerability of the kernel_read_file function in Linux kernels, related to improper memory release before deleting last references, allows a malicious actor to trigger a service failure.

The vulnerability of the kernelreadfile function in the Linux operating system’s kernel is related to a memory leak in the implementation of the vfsread handler. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially crafted file...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.30.1 - ext4: validate that metadata blocks do not overlap superblock Theodore Ts'o Orabug: 28220451 CVE-2018-1094 - ext4: always initialize the crc32c checksum driver Theodore Ts'o Orabug: 28220451 CVE-2018-1094 CVE-2018-1094 - vfs: Add sbrdonlysb to query the MSRDONLY flag ...

PT-2019-11588

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 5.0.4 Description: An issue was discovered in aio poll in fs/aio.c. A file may be released by aio poll wake if an expected event is triggered immediately, for example, by the close of a pair of pipes, after the...

Information Disclosure

samba4 is vulnerable to information disclosure attacks. The vulnerability exists when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRVSNAPSHOTARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from...

Security update for samba (moderate)

Samba was updated to 4.6.14, fixing bugs and security issues: Version update to 4.6.14 bsc1093664: + vfsceph: add fake async pwrite/pread send/recv hooks; bso13425. + Fix memory leak in vfsceph; bso13424. + winbind: avoid using fstrcpydcname,... in dualinitconnection; bso13294. + s3:smb2server:...

Microsoft Windows - Desktop Bridge VFS Privilege Escalation Exploit

Exploit for windows platform in category local exploits Windows: Windows: Desktop Bridge VFS EoP Platform: Windows 1709 not tested earlier version Class: Elevation of Privilege Summary: The handling of the VFS for desktop bridge applications can allow an application to create virtual files in...

Microsoft Windows - Desktop Bridge VFS Privilege Escalation

Microsoft Windows - Desktop Bridge VFS Privilege Escalation Windows: Windows: Desktop Bridge VFS EoP Platform: Windows 1709 not tested earlier version Class: Elevation of Privilege Summary: The handling of the VFS for desktop bridge applications can allow an application to create virtual files in...

Microsoft Windows - Desktop Bridge VFS Privilege Escalation

Windows: Windows: Desktop Bridge VFS EoP Platform: Windows 1709 not tested earlier version Class: Elevation of Privilege Summary: The handling of the VFS for desktop bridge applications can allow an application to create virtual files in system folder which can result in EoP. Description: The...

Directory traversal

The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did no...

CVE-2014-3626

The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did no...

CVE-2014-3626

The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did no...

Microsoft Desktop Bridge VFS Elevation of Privilege Vulnerability

Microsoft Windows 10 and others are a series of operating systems released by Microsoft Corporation in the U.S. Desktop Bridge Virtual File System VFS is one of these virtual file systems. An elevation of privilege vulnerability exists in Microsoft Desktop Bridge VFS, which stems from the program...

CVE-2018-0877

The Desktop Bridge Virtual File System VFS in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how file paths are managed, aka "Windows Desktop Bridge VFS Elevation of Privilege Vulnerability"...

CVE-2018-0877

CVE-2018-0877 affects the WCIFS (Windows Desktop Bridge VFS) driver. The root cause is improper handling of file paths in privileged Windows directories, allowing a reparse to a user-controlled location during a file-create path when the requested file did not exist in a trusted directory. This c...

Windows Desktop Bridge VFS Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Windows when the Desktop Bridge VFS does not take into acccount user/kernel mode when managing file paths. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs;...