Security Bulletin: IBM FileNet Content Manager security vulnerability in Administration Console for Content Platform Engine (ACCE) in Apache Commons Compress

Summary IBM FileNet Content Manager security vulnerability in Administration Console for Content Platform Engine ACCE in Apache Commons Compress v1.18 Vulnerability Details CVE-ID: CVE-2019-12402 Description: Apache Commons Compress is vulnerable to a denial of service, caused by an error in the...

Nagios XI 命令注入漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. Nagios XI 5.8.5 suffers from a security vulnerability that originates in the Manage Dashlets section of the...

CVE-2021-33602

A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive LZW decompression method, and this can crash the scanning engine. The vulnerability can be exploited remotely by an attacker. A successful attack will result in Denial-of-Service o...

Design/Logic Flaw

A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive LZW decompression method, and this can crash the scanning engine. The vulnerability can be exploited remotely by an attacker. A successful attack will result in Denial-of-Service o...

CVE-2021-33602

The CVE-2021-33602 issue affects the F-Secure Antivirus engine, where unpacking a ZIP archive via LZW decompression can crash the scanning engine. Exploitation is described as remote and can result in Denial-of-Service of the antivirus engine. Supported sources (Red Hat, NVD, CVE lists, CNNVD) co...

CVE-2021-33602 Denial-of-Service (DoS) Vulnerability

A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive LZW decompression method, and this can crash the scanning engine. The vulnerability can be exploited remotely by an attacker. A successful attack will result in Denial-of-Service o...

UBUNTU-CVE-2021-21706

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS...

EulerOS 2.0 SP8 : ant (EulerOS-SA-2021-2453)

According to the versions of the ant packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of...

CVE-2021-21706

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS...

ROS-2-2219

2.2219 Apache Ant utility vulnerability CVE-2021-36374, CVE-2021-36373 1. Vulnerability Description: CVE-2021-36374 A vulnerability in the Apache Ant utility, is related to the application improperly controlling internal resource consumption when processing ZIP archives. Exploitation of the...

ROS-2-1901

2.1901 Apache Ant utility vulnerability CVE-2021-36374, CVE-2021-36373 1. Vulnerability Description: CVE-2021-36374 A vulnerability in the Apache Ant utility, is related to the application improperly controlling internal resource consumption when processing ZIP archives. Exploitation of the...

Security Bulletin: IBM Content Navigator is vulnerable to a denial of service vulnerabilty.

Summary IBM Content Navigator has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2021-35516 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when allocate large amounts of memory. By persuading a victim to open ...

Detecting Embedded Content in OOXML Documents

On Advanced Practices, we are always looking for new ways to find malicious activity and track adversaries over time. Today we’re sharing a technique we use to detect and cluster Microsoft Office documents—specifically those in the Office Open XML OOXML file format. Additionally, we’re releasing ...

Malicious Ads Target Cryptocurrency Users With Cinobi Banking Trojan

A new social engineering-based malvertising campaign targeting Japan has been found to deliver a malicious application that deploys a banking trojan on compromised Windows machines to steal credentials associated with cryptocurrency accounts. The application masquerades as an animated porn game, ...

Security Bulletin: IBM API Connect is impacted by a vulnerability in Golang (CVE-2021-27919)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2021-27919 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the Reader.Open API when use a ZIP archive containing files start with “../”. By persuading a victim to...

Kuba 路径遍历漏洞

Kuba is a software package. Kuba suffers from a security vulnerability that allows an attacker to overwrite arbitrary files in any directory with a carefully crafted Zip file...

Security update for apache-commons-compress (important)

openSUSE Security Update: Security update for apache-commons-compress Announcement ID: openSUSE-SU-2021:1115-1 Rating: important References: 1188463 1188464 1188465 1188466 Cross-References: CVE-2021-35515 CVE-2021-35516 CVE-2021-35517 CVE-2021-36090 CVSS scores: CVE-2021-35515 NVD : 7.5...

OPENSUSE-SU-2021:1115-1 Security update for apache-commons-compress

This update for apache-commons-compress fixes the following issues: - Updated to 1.21 - CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. bsc1188463 - CVE-2021-35516: Fixed an excessive memory allocation when reading a specially crafted 7Z archive. bsc1188464 -...

SUSE SLED15 / SLES15 Security Update : apache-commons-compress (SUSE-SU-2021:2612-1)

The remote SUSE Linux SLED15 / SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2612-1 advisory. - Updated to 1.21 - CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. bsc1188463 - CVE-2021-35516:...

SUSE-SU-2021:2612-1 Security update for apache-commons-compress

This update for apache-commons-compress fixes the following issues: - Updated to 1.21 - CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. bsc1188463 - CVE-2021-35516: Fixed an excessive memory allocation when reading a specially crafted 7Z archive. bsc1188464 -...