Red Hat Security Advisory 2017-2669-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix: A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotify_handle_event() and vfs_rename() while running the rename operation against the same file. As a result of the race the next slab data or the slab's free list pointer can be corrupted with attacker-controlled data, which may lead to the privilege escalation.
e48d45b3299e25794baf01efaba70783d2cc37c96df4e1cb6cd794ff41e25ad0Red Hat Security Advisory 2017-2665-01 - Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic. Security Fix: An unsigned integer wrap around that led to a buffer over-read was found when parsing OFPT_QUEUE_GET_CONFIG_REPLY messages in Open vSwitch. An attacker could use this issue to cause a remote denial of service attack. While parsing an OpenFlow role status message Open vSwitch, a call to the abort() function for undefined role status reasons in the function 'ofp_print_role_status_message' in 'lib/ofp-print.c' could be misused for a remote denial of service attack by a malicious switch.
dbb8e5ff887b13c00ddd81935c1f2e73c939e1862f657cd32f27cfed814787a9Red Hat Security Advisory 2017-2649-01 - instack-undercloud provides a collection of scripts and elements that can be used to install an OpenStack undercloud. The following packages have been upgraded to a later upstream version: instack-undercloud. Security Fix: A flaw was found in instack-undercloud where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.
f1cf66a24c3b858623d5485c3174d54b7d05ab366eb7384c6deaf6eebecbed77Red Hat Security Advisory 2017-2648-01 - Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic. Security Fix: An unsigned int wrap around leading to a buffer over-read was found when parsing OFPT_QUEUE_GET_CONFIG_REPLY messages in Open vSwitch. An attacker could use this flaw to cause a remote DoS. In Open vSwitch, while parsing an OpenFlow role status message there is a call to the abort() function for undefined role status reasons in the function `ofp_print_role_status_message` in `lib/ofp-print.c` that may be leveraged toward a remote DoS attack by a malicious switch.
a89207e2a95563240c607a5d5422b72c90ed390784fb1efbcfddd8431ef00b24Red Hat Security Advisory 2017-2645-01 - Spacewalk is an Open Source systems management solution that provides system provisioning, configuration and patching capabilities. Red Hat Satellite is a system management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and the remote management of multiple Linux deployments with a single, centralized tool. Security Fix: A cross-site scripting flaw was found in how an organization name is displayed in Satellite 5. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.
8a992e6dd8e54952cf48342e3ad578d56ba1d845d4c319843d490666ba635f7eUbuntu Security Notice 3410-2 - USN-3410-1 fixed a vulnerability in GD Graphics Library. This update provides the corresponding update for Ubuntu 12.04 ESM. A It was discovered that the GD Graphics Library incorrectly A handled certain malformed PNG images. A remote attacker could use this A issue to cause the GD Graphics Library to crash, resulting in a denial A of service, or possibly execute arbitrary code. Various other issues were also addressed.
5f6af102e745a7efbde4209d2f971a4b18d9b2a59182e9dc21150660abdb9939Ubuntu Security Notice 3410-1 - It was discovered a double-free vulnerability in GD library. A remote attacker could write arbitrary values in memory spaces or made programs to crash.
14fc988aa2ac0d1a59fd89c749d2eaa1e34b6ce8dd8d2d767dc92aca1ca4390fRed Hat Security Advisory 2017-2638-01 - The jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services Elastic Compute Cloud. With this update, the jboss-ec2-eap package has been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 6.4.17. Security Fix: It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application.
148f1b5b157bb85b98e7fc15fbd63bb479cc20446692ce26b0423ee096234e56Red Hat Security Advisory 2017-2637-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red Hat JBoss Enterprise Application Platform 6.4.17 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.16, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix: It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application.
34b7987ca7a0081dd32bf5d091ad597a3a30a88a1adc46d70b82c05b55ec0b73Red Hat Security Advisory 2017-2635-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red Hat JBoss Enterprise Application Platform 6.4.17 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.16, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix: It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application.
98a346cb549f75e737c9f822095d637e791aba17b8c506b7ef6f23549bc4bcd1Ubuntu Security Notice 3411-1 - Adam Collard discovered that Bazaar did not properly handle host names in 'bzr+ssh://' URLs. A remote attacker could use this to construct a bazaar repository URL that when accessed could run arbitrary code with the privileges of the user.
1cd6ecc4d0c2f2a2272daab0fc85768c17ed8a7f56b2b81b5bb39734a54dbc27Red Hat Security Advisory 2017-2596-01 - Groovy is an agile and dynamic language for the Java Virtual Machine, built upon Java with features inspired by languages like Python, Ruby, and Smalltalk. It seamlessly integrates with all existing Java objects and libraries and compiles straight to Java bytecode so you can use it anywhere you can use Java. Security Fix: Multiple object deserialization flaws were discovered in the MethodClosure class in Groovy. A specially crafted serialized object deserialized by an application using the Groovy library could cause the application to execute arbitrary code.
9a3fe90d165c0f480786cf6cfcb7b902170219f6b47a31b1d9f3126027706526WordPress Gym Management System versions 07-05-2017 and below suffer from code execution and cross site scripting vulnerabilities.
9efa019c1cb620e30e7a52c8ef49d39c2f643c366a86adc046a9b08d976e3754WordPress Ads Pro plugin versions 3.4 and below suffers from cross site scripting and remote SQL injection vulnerabilities.
5001a2df25b2d3215d089d2ac91b25d0b038d813923b7691e688c609af5e99c8FiberHome suffers from an unauthenticated ADSL router factory reset vulnerability.
f551008561f7bbf94967cb06dab25dca8114151ace31bc1ba50b3bc12f82f2ea
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed