WP Reactions, LLC Security Vulnerabilities

openSUSE Security Update : lz4 (openSUSE-2019-2398)

This update for lz4 fixes the following issues : CVE-2019-17543: Fixed a heap-based buffer overflow in LZ4_write32 (bsc#1153936). This update was imported from the SUSE:SLE-15:Update update...

CVE-2021-47174

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version Arturo reported this backtrace: [709732.358791] WARNING: CPU: 3 PID: 456 at arch/x86/kernel/fpu/core.c:128 kernel_fpu_begin_mask+0xae/0xe0...

Class-Action Lawsuit against Google’s Incognito Mode

The lawsuit has been settled: Google has agreed to delete "billions of data records" the company collected while users browsed the web using Incognito mode, according to documents filed in federal court in San Francisco on Monday. The agreement, part of a settlement in a class action lawsuit...

openSUSE Security Update : MozillaFirefox (openSUSE-2019-1758)

This update for MozillaFirefox, mozilla-nss fixes the following issues : Security issues fixed : CVE-2018-18500: Fixed a use-after-free parsing HTML5 stream (bsc#1122983). CVE-2018-18501: Fixed multiple memory safety bugs (bsc#1122983). CVE-2018-18505: Fixed a privilege escalation...

openSUSE Security Update : rust (openSUSE-2019-2294)

This update for rust fixes the following issues : Rust was updated to version 1.36.0. Security issues fixed : CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978) CVE-2018-1000622: rustdoc loads plugins...

openSUSE Security Update : libseccomp (openSUSE-2019-2283)

This update for libseccomp fixes the following issues : Security issues fixed : CVE-2019-9893: An incorrect generation of syscall filters in libseccomp was fixed (bsc#1128828) libseccomp was updated to new upstream release 2.4.1 : Fix a BPF generation bug where the optimizer mistakenly ...

openSUSE Security Update : rust (openSUSE-2019-2244)

This update for rust fixes the following issues : Rust was updated to version 1.36.0. Security issues fixed : CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978) CVE-2018-1000622: rustdoc loads plugins...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-039)

The version of kernel installed on the remote host is prior to 5.15.149-99.161. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-039 advisory. 2024-05-23: CVE-2024-26625 was added to this advisory. 2024-05-23: CVE-2024-26668 was added to this...

CVE-2021-47174

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version Arturo reported this backtrace: [709732.358791] WARNING: CPU: 3 PID: 456 at arch/x86/kernel/fpu/core.c:128 kernel_fpu_begin_mask+0xae/0xe0...

openSUSE Security Update : python-ecdsa (openSUSE-2019-2474)

This update for python-ecdsa to version 0.13.3 fixes the following issues : Security issues fixed : CVE-2019-14853: Fixed unexpected exceptions during signature decoding (bsc#1153165). CVE-2019-14859: Fixed a signature malleability caused by insufficient checks of DER encoding...

openSUSE Security Update : ceph (openSUSE-2019-1284)

This update for ceph version 13.2.4 fixes the following issues : Security issues fixed : CVE-2018-14662: Fixed an issue with LUKS 'config-key' safety (bsc#1111177) CVE-2018-10861: Fixed an authorization bypass on OSD pool ops in ceph-mon (bsc#1099162) CVE-2018-1128: Fixed signature...

openSUSE Security Update : zziplib (openSUSE-2019-2396)

This update for zziplib fixes the following issues : Security issue fixed : CVE-2018-16548: Prevented memory leak from __zzip_parse_root_directory(). Free allocated structure if its address is not passed back. (bsc#1107424) Other issue addressed : Prevented a division by zero...

Unbreakable Enterprise kernel-container security update

[5.4.17-2136.330.7.1.el8] - KVM: x86: Add BHI_NO (Daniel Sneddon) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Pawan Gupta) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Pawan Gupta) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Enumerate...

openSUSE Security Update : kconfig / kdelibs4 (openSUSE-2019-1851)

This update for kconfig, kdelibs4 fixes the following issues : CVE-2019-14744: Fixed a command execution by an shell expansion...

openSUSE Security Update : libopenmpt (openSUSE-2019-2319)

This update for libopenmpt to version 0.3.19 fixes the following issues : CVE-2019-17113: Fixed a buffer overflow in ModPlug_InstrumentName and ModPlug_SampleName (bsc#1153102). This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : python-ecdsa (openSUSE-2019-2472)

This update for python-ecdsa to version 0.13.3 fixes the following issues : Security issues fixed : CVE-2019-14853: Fixed unexpected exceptions during signature decoding (bsc#1153165). CVE-2019-14859: Fixed a signature malleability caused by insufficient checks of DER encoding...

openSUSE Security Update : libvirt (openSUSE-2019-1294)

This update for libvirt fixes the following issues : Security issues fixed : CVE-2019-3840: Fixed a NULL pointer dereference vulnerability in virJSONValueObjectHasKey function which could have resulted in a remote denial of service via the guest agent (bsc#1127458). CVE-2019-3886:...

openSUSE Security Update : dhcp (openSUSE-2019-2340)

This update for dhcp fixes the following issues : Secuirty issue fixed : CVE-2019-6470: Fixed DHCPv6 server crashes (bsc#1134078). Bug fixes : Add compile option --enable-secs-byteorder to avoid duplicate lease warnings (bsc#1089524). Use IPv6 when called as dhclient6, dhcpd6, and...

openSUSE Security Update : dovecot23 (openSUSE-2019-2281)

This update for dovecot23 fixes the following issues : CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559) CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625). ...

openSUSE Security Update : dovecot23 (openSUSE-2019-2278)

This update for dovecot23 fixes the following issue : CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559) CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625). ...

openSUSE Security Update : openssl-1_0_0 (openSUSE-2019-2268)

This update for openssl-1_0_0 fixes the following issues : OpenSSL Security Advisory [10 September 2019] CVE-2019-1547: Added EC_GROUP_set_generator side channel attack avoidance. (bsc#1150003) CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key...

openSUSE Security Update : zstd (openSUSE-2019-1952)

This update for zstd fixes the following issues : Update to version 1.4.2 : bug: Fix bug in zstd-0.5 decoder by @terrelln (#1696) bug: Fix seekable decompression in-memory API by @iburinoc (#1695) bug: Close minor memory leak in CLI by @LeeYoung624 (#1701) misc: Validate blocks...

openSUSE Security Update : nghttp2 (openSUSE-2019-2232) (Data Dribble) (Resource Loop)

This update for nghttp2 fixes the following issues : Security issues fixed : CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to...

openSUSE Security Update : lz4 (openSUSE-2019-2399)

This update for lz4 fixes the following issues : CVE-2019-17543: Fixed a heap-based buffer overflow in LZ4_write32 (bsc#1153936). This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : libtomcrypt (openSUSE-2019-2454)

This update for libtomcrypt fixes the following issue : CVE-2019-17362: Fixed an improper detection of invalid UTF-8 sequences that could have led to DoS or information disclosure via crafted DER-encoded data (bsc#1153433). This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : nghttp2 (openSUSE-2019-2234) (Data Dribble) (Resource Loop)

This update for nghttp2 fixes the following issues : Security issues fixed : CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to...

openSUSE Security Update : python-numpy (openSUSE-2019-2225)

This update for python-numpy fixes the following issues : Non-security issues fixed : Updated to upstream version 1.16.1. (bsc#1149203) (jsc#SLE-8532) This update was imported from the SUSE:SLE-15:Update update...

Russian FSB Counterintelligence Chief Gets 9 Years in Cybercrime Bribery Scheme

The head of counterintelligence for a division of the Russian Federal Security Service (FSB) was sentenced last week to nine years in a penal colony for accepting a USD $1.7 million bribe to ignore the activities of a prolific Russian cybercrime group that hacked thousands of e-commerce websites......

openSUSE Security Update : libopenmpt (openSUSE-2019-2212)

This update for libopenmpt fixes the following issues : Security issues fixed : CVE-2018-20861: Fixed crash with certain malformed custom tunings in MPTM files (bsc#1143578). CVE-2018-20860: Fixed crash with malformed MED files (bsc#1143581). CVE-2019-14383: Fixed J2B that allows an...

openSUSE Security Update : go1.12 (openSUSE-2019-2521)

This update for go1.12 fixes the following issues : Security issues fixed : CVE-2019-16276: Fixed the handling of invalid HTTP headers, which had allowed request smuggling (bsc#1152082). CVE-2019-17596: Fixed a panic in dsa.Verify caused by invalid public keys (bsc#1154402). ...

openSUSE Security Update : libopenmpt (openSUSE-2019-2306)

This update for libopenmpt to version 0.3.19 fixes the following issues : CVE-2019-17113: Fixed a buffer overflow in ModPlug_InstrumentName and ModPlug_SampleName (bsc#1153102). This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : ansible (openSUSE-2019-1635)

This update for ansible fixes the following issues : Ansible was updated to version 2.8.1 : Full changelog is at /usr/share/doc/packages/ansible/changelogs/ Bugfixes ACI - DO not encode query_string ACI modules - Fix non-signature authentication Add missing directory provided via...

openSUSE Security Update : ruby-bundled-gems-rpmhelper / ruby2.5 (openSUSE-2019-1771)

This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues : Changes in ruby2.5 : Update to 2.5.5 and 2.5.4 : https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed : ...

openSUSE Security Update : GraphicsMagick (openSUSE-2019-2317)

This update for GraphicsMagick fixes the following issues : CVE-2019-16709: Fixed a memory leak in coders/dps.c ...

openSUSE Security Update : ibus (openSUSE-2019-2174)

This update for ibus fixes the following issues : Security issue fixed : CVE-2019-14822: Fixed a misconfiguration of the DBus server that allowed an unprivileged user to monitor and send method calls to the ibus bus of another user. (bsc#1150011) This update was imported from the...

openSUSE Security Update : openssl-1_0_0 (openSUSE-2019-2269)

This update for openssl-1_0_0 fixes the following issues : OpenSSL Security Advisory [10 September 2019] CVE-2019-1547: Added EC_GROUP_set_generator side channel attack avoidance. (bsc#1150003) CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key...

openSUSE Security Update : libtomcrypt (openSUSE-2019-2514)

This update for libtomcrypt fixes the following issue : CVE-2019-17362: Fixed an improper detection of invalid UTF-8 sequences that could have led to DoS or information disclosure via crafted DER-encoded data (bsc#1153433). This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : slurm (openSUSE-2019-2052)

This update for slurm to version 18.08.8 fixes the following issues : Security issue fixed : CVE-2019-12838: Fixed a SQL injection in slurmdbd (bsc#1140709). This update was imported from the SUSE:SLE-15-SP1:Update update...

openSUSE Security Update : apache2-mod_perl (openSUSE-2019-2549)

This update for apache2-mod_perl to version 2.0.11 fixes the following issues : Security issue fixed : CVE-2011-2767: Fixed a vulnerability which could have allowed perl code execution in the context of user account (bsc#1156944). Other issue addressed : Restore process name after...

openSUSE Security Update : rdesktop (openSUSE-2019-2135)

This update for rdesktop fixes the following issues : rdesktop was updated to 1.8.6 : Fix protocol code handling new licenses rdesktop was updated to 1.8.5 : Add bounds checking to protocol handling in order to fix many security problems when communicating with a malicious server. ...

openSUSE Security Update : chromium (openSUSE-2019-2152)

This update for chromium to 77.0.3865.75 fixes the following issues : Security issues fixed : CVE-2019-5870: Fixed a use-after-free in media. (boo#1150425) CVE-2019-5871: Fixed a heap overflow in Skia. (boo#1150425) CVE-2019-5872: Fixed a use-after-free in Mojo (boo#1150425) ...

Unbreakable Enterprise kernel security update

[5.4.17-2136.330.7.1] - KVM: x86: Add BHI_NO (Daniel Sneddon) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Pawan Gupta) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Pawan Gupta) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Enumerate Branch...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-053)

The version of kernel installed on the remote host is prior to 5.10.210-201.852. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-053 advisory. 2024-05-23: CVE-2024-26625 was added to this advisory. 2024-05-23: CVE-2024-26665 was added to this...

openSUSE Security Update : gdal (openSUSE-2019-2466)

This update for gdal to version 2.4.3 fixes the following issues : gdal was updated to 2.4.3 : CVE-2019-17545: Fixed a double free vulnerability in OGRExpatRealloc (boo#1153918). Multiple bug and stability fixes For more information regarding the release at: ...

Stark Industries Solutions: An Iron Hammer in the Cloud

The homepage of Stark Industries Solutions. Two weeks before Russia invaded Ukraine in February 2022, a large, mysterious new Internet hosting firm called Stark Industries Solutions materialized and quickly became the epicenter of massive distributed denial-of-service (DDoS) attacks on government.....

openSUSE Security Update : libssh2_org (openSUSE-2019-2482)

This update for libssh2_org fixes the following issue : CVE-2019-17498: Fixed an integer overflow in a bounds check that might have led to the disclosure of sensitive information or a denial of service (bsc#1154862). This update was imported from the SUSE:SLE-15:Update update...

JVN#97751842: Multiple vulnerabilities in MosP kintai kanri

MosP kintai kanri provided by esMind, LLC contains multiple vulnerabilities listed below. Path Traversal (CWE-22) CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Base Score 6.5 CVE-2024-28880 Incorrect Permission Assignment for Critical Resource (CWE-732) CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.....

openSUSE Security Update : webkit2gtk3 (openSUSE-2019-2207)

This update for webkit2gtk3 fixes the following issues : Security issues fixed : CVE-2019-8673, CVE-2019-8678, CVE-2019-8686, CVE-2019-8683, CVE-2019-8671, CVE-2019-8595, CVE-2019-8684, CVE-2019-8681, CVE-2019-8615, CVE-2019-8689, CVE-2019-8680, CVE-2019-8672, CVE-2019-8676,...

openSUSE Security Update : libssh2_org (openSUSE-2019-2483)

This update for libssh2_org fixes the following issue : CVE-2019-17498: Fixed an integer overflow in a bounds check that might have led to the disclosure of sensitive information or a denial of service (bsc#1154862). This update was imported from the SUSE:SLE-15:Update update...

CVE-2022-28356

In the Linux kernel before 5.17.1, a refcount leak bug was found in...