The client in OpenAFS before 1.6.17 does not properly initialize the (1) AFSStoreStatus, (2) AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4) ListAddrByAttributes structures, which might allow remote attackers to obtain sensitive memory information by leveraging access to RPC call traffic.
Monthly Archives: May 2016
Threatpost News Wrap, May 13, 2016
Mike Mimoso and Chris Brook discuss the news of the week, including zero day vulnerabilities–both in Adobe Flash and Windows, a nasty vulnerability in SAP business applications, Mozilla asking FBI to disclose a Tor exploit, and more.
HP Security Bulletin HPSBMU03591 1
HP Security Bulletin HPSBMU03591 1 – Several potential security vulnerabilities have been identified in HPE Server Migration Pack (SMP) on Windows and Linux. The vulnerabilities could be exploited remotely resulting in Denial of Service (DoS). Revision 1 of this advisory.
HP Security Bulletin HPSBMU03589 1
HP Security Bulletin HPSBMU03589 1 – Several potential security vulnerabilities have been identified with HPE Version Control Repository Manager (VCRM) on Windows and Linux. The vulnerabilities could be exploited remotely resulting in Denial of Service (DoS). Revision 1 of this advisory.
Red Hat Security Advisory 2016-1080-01
Red Hat Security Advisory 2016-1080-01 – Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 50.0.2661.102. Security Fix: Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim.
Red Hat Security Advisory 2016-1079-01
Red Hat Security Advisory 2016-1079-01 – The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 11.2.202.621. Security Fix: This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content.
HP Security Bulletin HPSBMU03590 1
HP Security Bulletin HPSBMU03590 1 – Several potential security vulnerabilities have been identified in HPE Systems Insight Manager (SIM) on Windows and Linux. The vulnerabilities could be exploited remotely resulting in Denial of Service (DoS), execution of arbitrary code, disclosure of information, Cross-site Request Forgery (CSRF), and Cross-site scripting (XSS). Revision 1 of this advisory.
Red Hat Security Advisory 2016-1060-01
Red Hat Security Advisory 2016-1060-01 – PostgreSQL is an advanced object-relational database management system. Security Fix: An integer overflow flaw, leading to a heap-based buffer overflow, was found in the PostgreSQL handling code for regular expressions. A remote attacker could use a specially crafted regular expression to cause PostgreSQL to crash or possibly execute arbitrary code.
Red Hat Security Advisory 2016-1064-01
Red Hat Security Advisory 2016-1064-01 – OpenShift Enterprise by Red Hat is the company’s cloud computing Platform- as-a-Service solution designed for on-premise or private cloud deployments. Security Fix: A flaw was found in the building of containers within OpenShift Enterprise. An attacker could submit an image for building that executes commands within the container as root, allowing them to potentially escalate privileges.
HP Security Bulletin HPSBGN03597 1
HP Security Bulletin HPSBGN03597 1 – A vulnerability in GNU C Library (glibc) was addressed by HPE Cloud Optimizer (Virtualization Performance Viewer). The vulnerability could be exploited remotely to allow Denial of Service (DoS). Revision 1 of this advisory.