Red Hat Security Advisory 2017-1839-01 - The jackson-databind package provides general data-binding functionality for Jackson, which works on top of Jackson core streaming API. Security Fix: A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
1ce77e8008f791047c59b64f6f67fd895b63b533efb776d873bda60eee68a8aaUbuntu Security Notice 3372-1 - It was discovered that NSS incorrectly handled certain empty SSLv2 messages. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service. Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update causes NSS to limit use of the same symmetric key. Various other issues were also addressed.
e388acc86dcf59e73c62e313ac038fabb06265810beaf16fd3db321a90afdfb4Red Hat Security Advisory 2017-1834-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red Hat JBoss Enterprise Application Platform 7.0.7 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.0.6, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References. Security Fix: A deserialization flaw was discovered in jackson-databind which could allow an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of the ObjectMapper.
8f515b16a851986c500ddf4ed6503d67dd3f7d5c26eead92d7b32eb5b1479c75Red Hat Security Advisory 2017-1837-01 - The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services Elastic Compute Cloud. With this update, the eap7-jboss-ec2-eap package has been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 7.0.7.
dc07b245ad6d917f3af654df1bff7e1343625687d28a626a8a04cd51b5dee892Red Hat Security Advisory 2017-1838-01 - PostgreSQL is an advanced object-relational database management system. Security Fix: It was found that some selectivity estimation functions did not check user privileges before providing information from pg_statistic, possibly leaking information. A non-administrative database user could use this flaw to steal some information from tables they are otherwise not allowed to access.
b8da1a65f0ca936bedb76c56b840e6863ef2bc0aa2a3073a608795956545a09aUbuntu Security Notice 3373-1 - Emmanuel Dreyfus discovered that third-party modules using the ap_get_basic_auth_pw function outside of the authentication phase may lead to authentication requirements being bypassed. This update adds a new ap_get_basic_auth_components function for use by third-party modules. Vasileios Panopoulos discovered that the Apache mod_ssl module may crash when third-party modules call ap_hook_process_connection during an HTTP request to an HTTPS port. Various other issues were also addressed.
4a9a5dea68311374e8d780883cdb344eae2007b3b5ebe311aa079e3e743f2f21Red Hat Security Advisory 2017-1835-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red Hat JBoss Enterprise Application Platform 7.0.7 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.0.6, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References. Security Fix: A deserialization flaw was discovered in jackson-databind which could allow an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of the ObjectMapper.
3691e18fee16447c266d5cd96d4cb0974d75008e1132ec48a76ce9bcac67a084Ubuntu Security Notice 3374-1 - It was discovered that RabbitMQ incorrectly handled MQTT authentication. A remote attacker could use this issue to authenticate successfully with an existing username by omitting the password.
447342daddaff1041b3b306feeb7a80790814f09559f4b1da0e7811886211c50Red Hat Security Advisory 2017-1840-01 - The jackson-databind package provides general data-binding functionality for Jackson, which works on top of Jackson core streaming API. Security Fix: A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
ddd84e1c28044f497afd84cb2e121261164c88de9c73f5305489781ccea648d2The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis version 1.3.5 can cause a denial of service (OOM) via a crafted wav file.
7579257c139a0255d0050c599ca09747f8e3646f71f6269c586a92c46e5abf32Ubuntu Security Notice 3363-2 - USN-3363-1 fixed vulnerabilities in ImageMagick. The update caused a regression for certain users when processing images. The problematic patch has been reverted pending further investigation. It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. Various other issues were also addressed.
af6b57c695da99e12cc3f5ab75ad730a6c23b4ed2482af57284cd813dc18ec32The startread function in wav.c in Sound eXchange(SoX) version 14.4.2 can cause a denial of service (divide-by-zero error and application crash) via a crafted wav file.
af14da524a2fb01df11b7535dcdaae5b1869c70f4a3349cfc2f7fa546f6b8d34Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 suffers from a persistent cross site scripting vulnerability.
436fa0bce96b432cc53cebe95a1a22ae31fb0609f0f4a08f9049bd7a51546ec4The insert_note_steps function in readmidi.c in TiMidity++ version 2.14.0 can cause a denial of service (divide-by-zero error and application crash) via a crafted mid file.
22dd3ae9d9d61dac3e51d459d2c11efba61808fc42ebf8b08223e5399db6479eThe id3_ucs4_length function in ucs4.c in libid3tag version 0.15.1b can cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.
b165ba6c2059549e131498730a65033270647ae0d9f87b03e7f8557fecc87b97MEDHOST Connex contains a hard-coded Mirth Connect administrative credential that is used for customer Mirth Connect management access.
cda33f4b8f74ced06fc2e4ed54419dc5dfee4468eadbb61de781b387fcd999b6The mad_decoder_run function in decoder.c in libmad version 0.15.1b can cause a denial of service (memory corruption) via a crafted mp3 file.
c6cce95ec4be2cbec7c267429a6a982988b373f894144e141477d2b2b2f28f67Ubuntu Security Notice 3366-2 - USN-3366-1 fixed vulnerabilities in OpenJDK 8. Unfortunately, that update introduced a regression that caused some valid JAR files to fail validation. This update fixes the problem. It was discovered that the JPEGImageReader class in OpenJDK would incorrectly read unused image data. An attacker could use this to specially construct a jpeg image file that when opened by a Java application would cause a denial of service. Various other issues were also addressed.
e9581a312ef7c1eb2dedb9df0dc68f52b06260cac0f6b85c8b55f77958b4e34eThe _tokenize_matrix function in audio_out.c in Xiph.Org libao version 1.2.0 can cause a denial of service (memory corruption) via a crafted mp3 file.
2d194a8acef51dcd0b21a341eb04a87880fd0a401aeeab8b4fdd34e06cecce1bALZip version 8.51 suffers from buffer overflow and file creation vulnerabilities.
c12e8fcc5c3c680d7dde2ca1257975ec8e0e2540c23524db4d6266b0322dd514The wav_open function in oggenc/audio.c in vorbis-tools version 1.4.0 can cause a denial of service (memory allocation error) via a crafted wav file.
842a04f4decc33b5213edeb39b31fccf5962ed48f9b3b5285d2bc91479c0f279Red Hat Security Advisory 2017-1833-01 - Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 60.0.3112.78. Security Fix: Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim.
ad472c82dc102ba322984772143f99c483ca21f4adddbeb37cb9a6d3f0ecdd3eDivFix++ version 0.34 suffers from a denial of service vulnerability.
a846092067346222e8d5593d32693e3acab6715c2e2ab5b4dd74c2f099b968f2Red Hat Security Advisory 2017-1833-01 - Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 60.0.3112.78. Security Fix: Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim.
1353fd8d2deddb910e8700dee9e46a94525d8a937157e32db4ea34204c38bf58
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed