March 12, 2019—KB4489891 (Monthly Rollup)

None None...

xorg Windowing System Settings Alteration

The vulnerability of the window system for creating a graphical user interface in the Astra Linux operating system’s xorg lies in an incorrect setting of the allow-user-xsession parameter in "/etc/X11/Xsession.options". Exploiting this vulnerability could allow a hacker to alter the default...

Astra Linux fly-wm DoS

The vulnerability of the window blocking component of the fly-wm operating system’s Astra Linux device lies in a flaw that causes the window blocking component to fail to execute, especially when the XGrabKeyboard call has already been made by another client. Exploiting this vulnerability could...

CVE-2019-1702

Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the affected software. The vulnerabilities are due...

Android - binder Use-After-Free via racy Initialization of ->allow_user_free

The following bug report solely looks at the situation on the upstream master branch; while from a cursory look, at least the wahoo kernel also looks affected, I have only properly tested this on upstream master. The binder driver permits userspace to free buffers in the kernel-managed shared...

Android - binder Use-After-Free via racy Initialization of ->allow_user_free Exploit

Android - binder Use-After-Free via racy Initialization of -allowuserfree Exploit The following bug report solely looks at the situation on the upstream master branch; while from a cursory look, at least the wahoo kernel also looks affected, I have only properly tested this on upstream master. Th...

Android - binder Use-After-Free of VMA via race Between reclaim and munmap Exploit

Android - binder Use-After-Free of VMA via race Between reclaim and munmap The following bug report solely looks at the situation on the upstream master branch; while from a cursory look, at least the wahoo kernel also looks affected, I have only properly tested this on upstream master. There is ...

How to Delete Accidentally Sent Messages, Photos on Facebook Messenger

Ever sent a message on Facebook Messenger then immediately regretted it, or an embarrassing text to your boss in the heat of the moment at late night, or maybe accidentally sent messages or photos to a wrong group chat? Of course, you have. We have all been through drunk texts and embarrassing...

libX11 Heap Buffer Overflow DoS

The vulnerability of the XListExtensions function ListExt.c in the client API library for the X Window System libX11 is related to an “unit not counted” error. Exploiting this vulnerability allows a remote attacker to cause a service failure through a specially crafted server response...

Security Bulletin: IBM Systems Director (ISD) is affected by vulnerability in the Console Login Window (CVE-2013-5423)

Summary IBM Systems Director is affected by a vulnerability in the Console Login Window CVE-2013-5423. Vulnerability Details Abstract IBM Systems Director is affected by a vulnerability in the Console Login Window CVE-2013-5423. Content Vulnerability Details: CVE-ID: CVE-2013-5423 Description: Th...

SUSE SLED12 / SLES12 Security Update : PackageKit (SUSE-SU-2019:0128-1)

This update for PackageKit fixes the following issues : Fixed displaying the license agreement pop up window during package update bsc1038425. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

dnSpy - .NET Debugger And Assembly Editor

dnSpy is a debugger and .NET assembly editor. You can use it to edit and debug assemblies even if you don't have any source code available. Want to say thanks? Click the star at the top of the page. Or fork dnSpy and send a PR! The following pictures show dnSpy in action. It shows dnSpy editing a...

January 17, 2019—KB4480955 (Preview of Monthly Rollup)

None None...

January 17, 2019—KB4480974 (Preview of Monthly Rollup)

None None...

Denial Of Service (DoS)

xorg-x11-server is vulnerable to denial of service DoS attacks. The vulnerability exists as X.Org X Window System aka X11 and X X11R5 and X.Org Server aka xserver and xorg-server before 1.16.3, when using SUN-DES-1 Secure RPC authentication credentials, does not check the return value of a malloc...

January 15, 2019—KB4480967 (OS Build 16299.936)

None None...

January 15, 2019—KB4480976 (OS Build 17134.556)

None None...

January 15, 2019—KB4480969 (Preview of Monthly Rollup)

None None...

CVE-2018-6096

A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...

Design/Logic Flaw

A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscure the full screen warning via a crafted HTML page...