Denial Of Service (DoS)

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.82. See the following advisory for the container...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of serviceDoS attacks. This exists in the sassmpgetphyevents function in drivers/scsi/libsas/sasexpander.c which allows local users to cause a denial of service kernel memory exhaustion via multiple read accesses to files in the /sys/class/sasphy directory...

Memory Corruption

Linux kernel is vulnerable to memory corruption attacks. An attacker could exploit a flaw in the ext4 filesystem to cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of serviceDoS attacks. A local user could exploit a flaw in the madvisewillneed function in mm/madvise.c to cause application crash by triggering use of MADVISEWILLNEED for a DAX mapping...

Denial Of Service (DoS)

Linux Kernel is vulnerable to denial of service. Missing length check of payload in sctpmakechunk function allows a local attacker to cause a kernel crash. The file net/sctp/smmakechunk.c of the component SCTP Packet Handler is affected...

Denial Of Service (DoS)

Oniguruma is vulnerable to denial-of-service attacks. A remote unauthenticated attacker could exploit the flawed function leftadjustcharhead of the component Regular Expressionresult causing an invalid pointer dereference resulting in denial-of-service conditions...

Use After Free

PHP is vulnerable to use after free vulnerability. The vulnerability exists in the wddxstackdestroy function in ext/wddx/wddx.c in PHP. Remote attackers could cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset...

Denial Of Service (DoS)

PHP is vulnerable to denial of service DoS attacks. The vulnerability exists in the ext/intl/msgformat/msgformatformat.c in PHP. Remote attackers could cause a denial of service or possibly have unspecified other impact via a MessageFormatter::formatMessage call with a long first argument...

Denial Of Service (DoS)

Oracle Java SE is vulnerable to denial of service DoS attacks. The vulnerability exists in an unknown function of the component Security. An unauthenticated attacker with network access via multiple protocols could compromise Java SE, Java SE Embedded, JRockit causing a parital denial of service...

Arbitrary Code Execution

GNU C Library is vulnerable to arbitrary code execution. A remote unauthenticated attacker could cause a buffer overflow during unescaping of user names with the operator resulting in denial of service conditions and code execution attacks...

Denial Of Service (DoS)

Oracle MySQL is vulnerable to denial of service attacks. A remote authenticated user with low privileges could compromise MySQL Server via multiple protocols resulting in a system crash. Affected is the component DDL...

Arbitrary Code Execution

Ruby is vulnerable to arbitrary code execution attacks. A context-dependent attacker could exploit a flaw in the Fiddle::Handle implementation in ext/fiddle/handle.c to cause a denial of service application crash via a crafted string, related to the DL module and the libffi library...

Improper Access Control

Oracle Java SE is vulnerable to improper access control vulnerability. This occurs in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: AWT. An unauthenticated attacker with network access via multiple protocols could compromise Java SE, Java SE Embedded with the help of...

Denial Of Service (DoS)

RubyGems is vulnerable to denial of service attacks. A local attacker can supply a specially crafted 'query' command to cause denial of service conditions by excessive CPU usage while parsing a sufficiently long gem summary. Query Command Handler is the affected component...

Regular Expression Denial-of-Service (DoS)

remarkable is vulnerable to regex denial of service. Malicious users can craft a string inside the CDATA tag to cause the regex function to consume a large amount of system resources that could potentially result in a crash...

Privilege Escalation

Oracle MySQL is vulnerable to privilege escalation attacks. A remote, authenticated attacker could insert malicious input leading to the exploitation of the flawed Client programs component to gain elevated privileges. Successful attacks could result in unauthorized access to critical data or...

Man-In-The-Middle

Oracle MySQL is vulnerable to man-in-the-middle attacks. The attacker could hijack client's authentication to the server even if the client was configured to require SSL connection since MySQL client command line tools only checks after authentication whether server supported SSL. Affected...

Denial Of Service (DoS)

Apache httpd is vulnerable to denial of service attacks. The modauthdigest component does not properly initialize memory used to process 'Digest' type HTTP Authorization headers allowing a remote attacker to send a specially crafted request to view potentially sensitive information from the...

Privilege Escalation

Java SE, Java SE Embedded and JRockit are vulnerable to privilege escalation attacks. A remote, unauthenticated attacker could submit malicious input leading to the exploitation of the flawed Security component to gain elevated privileges. Successful attacks could result in takeover of Java SE,...

NULL Pointer Dereference

Linux Kernel is vulnerable to null pointer dereference. The vulnerability is possible because the hashaccept call in kernel fails to work on sockets that have not received any data causing a denial of service condition application crash...

Out-of-bounds Write

libtiff is vulnerable to out-of-bounds write attacks. A user can use this to cause a system crash or overwrite variables currently in the buffer. It is possible through a function in tifpixarlog.c. which leads to buffer overflows...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of serviceDoS attacks. blkrqmapuseriov function in the Linux kernel's block device implementation does not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a use-after-fre...

Denial Of Service (DoS)

IPv6 protocol is vulnerable to denial of serviceDos attacks. Remote attacker could leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow and subsequently perform any type of a fragmentation-based attack against legacy IPv6 nodes that do not...

Cross-site Scripting (XSS)

Firefox ESR and Firefox are vulnerable to cross-site scripting XSS attacks. A remote attacker can exploit an input validation flaw in the Pocket server to execute arbitrary JavaScript in the about:pocket-saved page and access the Pocket messaging API...

Denial Of Service (DoS)

Red Hat JBoss Web Server is vulnerable to denial of service DoS attacks. It is possible to remotely Segfault Apache http server with a specially crafted string sent to the modcluster via service messages MCMP which results in a server crash DOS...

Denial Of Service (DoS)

libtiff is vulnerable to denial of service DoS attacks. This allows remote attackers to affect the availability via a crafted TIFF image, as demonstrated by libtiff-cvs-1.tif and libtiff-cvs-2.tif...

Brute Force Attack

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Arbitrary Code Execution

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Arbitrary Code Execution

Red Hat Gluster Storage is a software only scale-out storage solution that provides flexible and affordable unstructured data storage. It unifies data storage and infrastructure, increases performance, and improves availability and manageability to meet enterprise-level storage challenges. Red Ha...

Sandbox Restrictions Bypass

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java...

Arbitrary Code Execution

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Ja...

Buffer Overflow

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Arbitrary Code Execution

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Memory Corruption

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. It was found that the Linux kernel's implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic acce...

Denial Of Service (DoS)

nginx is vulnerable to denial of service DoS. The vulnerability exists through a null pointer dereference flaw when saving client request body to a temporary file...

Denial Of Service (DoS)

ntp is vulnerable to denial of service DoS. The vulnerability exists as it is possible to send a crypto NAK packet from a spoofed source address of an associated peer...

Denial Of Service (DoS)

rh-mariadb100-mariadb is vulnerable to denial of service DoS. The vulnerability exists through the pcrecompile2 function in pcrecompile.c...

Denial Of Service (DoS)

MySQL Server is vulnerable to denial of service DoS attacks. The vulnerability exists as an unspecified vulnerability in Oracle MySQL .This allows a remote authenticated user to manipulate with an unknown input, causing the application to crash. The affected component is InnoDB...

Use-After-Free

Mozilla Network Security ServicesNSS is vulnerable to use-after-free attacks. This allows remote attackers to case denial of service via crafted key data with DER encoding...

Denial Of Service (DoS)

The kernel packages contain the Linux kernel, the core of any Linux operating system. An integer overflow flaw was found in the way the Linux kernel's Frame Buffer device implementation mapped kernel memory to user space via the mmap syscall. A local user able to access a frame buffer device file...

Sensitive Information Disclosure

OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud deployments. The following security issues are addressed with this release: An authorization flaw was discovered in Kubernetes; the API server did not...

Buffer Overflow

Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird...

Denial Of Service

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws t...

Arbitrary Code Execution

libxfont is vulnerable to arbitrary code execution. An integer truncation flaw was discovered in the way libXfont processed certain Glyph Bitmap Distribution Format BDF fonts. A malicious, local user could use this flaw to crash the X.Org server or, potentially, execute arbitrary code with the...

Denial Of Service (DoS)

Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird...

Denial Of Service (DoS)

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update...

Denial Of Service (DoS)

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause t...

Arbitrary Code Execution

Kerberos is a networked authentication system which allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos KDC. The following security issues are fixed with this release: A use-after-free flaw was found in the way the MIT Kerberos libgssapikr...

Integer Overflow

The X11 Xorg libraries provide library routines that are used within all X Window applications. Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol da...

Integer Overflow

The X11 Xorg libraries provide library routines that are used within all X Window applications. Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol da...