Monthly Archives: December 2016
GLSA 201701-03: libarchive: Multiple vulnerabilities
CVE-2016-9942
Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions.
CVE-2016-9941
Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.
bzip2-1.0.6-21.fc24
CVE-2016-3189 bzip2: heap use after free in bzip2recover
bzip2-1.0.6-21.fc25
CVE-2016-3189 bzip2: heap use after free in bzip2recover
New Year's resolutions from the Avast dogs
Avast is full of dog lovers, and as such, we aspire to “…to be the person my dog thinks I am.” This inspirational quote, attributed to Victorian author Mary Ann Evans, who went by the pen name George Eliot (Silas Marner and Middlemarch), speaks to our best friend’s unconditional love and non-judgmental acceptance.
CVE-2016-6858
Cross-site scripting (XSS) vulnerability in the Create Employee feature in Hybris Management Console (HMC) in SAP Hybris before 5.0.4.11, 5.1.0.x before 5.1.0.11, 5.1.1.x before 5.1.1.12, 5.2.0.x and 5.3.0.x before 5.3.0.10, 5.4.x before 5.4.0.9, 5.5.0.x before 5.5.0.9, 5.5.1.x before 5.5.1.10, 5.6.x before 5.6.0.8, and 5.7.x before 5.7.0.9 allows remote authenticated users to inject arbitrary web script or HTML via the Name field.
CVE-2016-6859
Hybris Management Console (HMC) in SAP Hybris before 6.0 allows remote attackers to obtain sensitive information by triggering an error and then reading a Java stack trace.
CVE-2016-6856
Cross-site scripting (XSS) vulnerability in the Inbox Search feature in Hybris Management Console (HMC) in SAP Hybris before 6.0 allows remote attackers to inject arbitrary web script or HTML via the itemsperpage parameter.