Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Potential remote code execution during URN processing (CVE-2019-12526). Multiple improper validations in URI processing (CVE-2019-12523, CVE-2019-18676).
Heap based overflow in jas_icctxtdesc_input (CVE-2018-19540). Heap based overread in jas_image_depalettize (CVE-2018-19541). References:
NULL ptr dereference (crash) in the moodbar pipeline (CVE-2019-14332). References: - https://bugs.mageia.org/show_bug.cgi?id=25753 - https://lists.opensuse.or…
It was discovered that there was unsafe deserialisation issue in cacti, server monitoring system system. Unsafe deserialisation of objects which can lead to ab…
Several vulnerabilities have been discovered in git, a fast, scalable, distributed revision control system. CVE-2019-1348
More deserialization flaws were discovered in jackson-databind which could allow an unauthenticated user to perform remote code execution. The issue was resolv…
A security update is now available for Open Liberty 19.0.0.12 from the Customer Portal. Red Hat Product Security has rated this update as having a security imp…
In HTMLDOC, there was a one-byte underflow in htmldoc/ps-pdf.cxx caused by a floating point math difference between GCC and Clang.
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/display_git_revision.lib.php and libraries/Footer.class.php.
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in denial of service, sandbox bypass, informa…
Two vulnerabilities were discovered in NSS, a set of cryptographic libraries, which may result in denial of service and potentially the execution of arbitrary …
Several vulnerabilities were discovered in the Oniguruma regular expressions library, notably used in PHP mbstring.
An update for python-jinja2 is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Suppo…
An update for patch is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and …
An update for kernel is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and…
A corrupted or specially crafted CRW images might exceed the overall buffersize to cause a denial of service.
A security update is now available for Red Hat Single Sign-On 7.3 from the Customer Portal. Red Hat Product Security has rated this update as having a security…
Upstream announcement: **phpMyAdmin 4.9.2 is released** 2019-11-22 Welcome to phpMyAdmin 4.9.2, a bugfix release that also contains a security fix. This securi…
Upstream announcement: **phpMyAdmin 4.9.2 is released** 2019-11-22 Welcome to phpMyAdmin 4.9.2, a bugfix release that also contains a security fix. This securi…
In mod_tls a crash with empty CRL was fixed. For Debian 8 "Jessie", this problem has been fixed in version 1.3.5e+r1.3.5-2+deb8u5.
Several vulnerabilites are fixed in Asterisk, an Open Source PBX and telephony toolkit. CVE-2019-13161
In tnef, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attach…
A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values.
Several vulnerabilities have been identified in the VNC code of ssvnc, an encryption-capable VNC client..
