Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js vulnerabilities

Summary IBM Cloud Transformation Advisor has addressed the following vulnerabilities in Node.js CVE-2019-9511, CVE-2019-9516, CVE-2019-9512, CVE-2019-9517, CVE-2019-9518, CVE-2019-9515, CVE-2019-9513, CVE-2019-9514 Vulnerability Details CVEID: CVE-2019-9511 DESCRIPTION: Some HTTP/2 implementation...

CVE-2019-16779

In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted such as by a timeout would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition...

[SECURITY] Fedora 30 Update: xpdf-4.02-2.fc30

Xpdf is an X Window System based viewer for Portable Document Format PDF files. Xpdf is a small and efficient program which uses standard X fonts...

[SECURITY] Fedora 31 Update: xpdf-4.02-2.fc31

Xpdf is an X Window System based viewer for Portable Document Format PDF files. Xpdf is a small and efficient program which uses standard X fonts...

Remote Code Execution (RCE)

treekill is vulnerable to remote code execution RCE. The attack is possible because the process in window part does not validate the user input part before the concatenation of the input with a command using + operator and directly execute the command, allowing a remote user to inject arbitrary...

[SECURITY] Fedora 30 Update: ImageMagick-6.9.10.75-1.fc30

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

Apache Tomcat Resource Consumption DoS

The vulnerability of the Apache Tomcat application server is related to an uncontrolled consumption of resources. Exploiting this vulnerability allows a malicious actor to cause service failures when the WINDOWUPDATE message is not sent to the connection window thread 0...

xlockmore Access Control Error Vulnerability

xlockmore is a screen saver for the X Window system. An Access Control Error vulnerability exists in xlockmore versions 5.13 and 5.22, which arises from a networked system or product that does not properly restrict access to resources from unauthorized roles and can be exploited by an attacker to...

[SECURITY] Fedora 31 Update: ImageMagick-6.9.10.75-1.fc31

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

HTTP/2: large amount of data requests leads to denial of service

A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a...

HTTP/2: large amount of data requests leads to denial of service

A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a...

HTTP/2: large amount of data requests leads to denial of service

A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a...

HTTP/2: large amount of data requests leads to denial of service

A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a...

libX11 Heap Buffer Overflow DoS

The vulnerability of the XListExtensions function ListExt.c in the client API library for the X Window System libX11 is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

CVE-2019-19244

sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage...

DEBIAN-CVE-2019-19244

sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage...

ALPINE-CVE-2019-19244

sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage...

CVE-2019-19244

sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage...

Sql injection

sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage...

CVE-2019-19244

CVE-2019-19244 affects SQLite 3.30.1, where sqlite3Select in select.c can crash if a sub‑select uses both DISTINCT and window functions and there is particular ORDER BY usage. The consequence is a denial of service via crash. Connected IBM/ASTRA pages confirm the CVE and describe the same SQLite ...