Ubuntu Security Notice 3313-2 - USN-3313-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.10. This update provides the corresponding updates for the Linux Hardware Enablement kernel from Ubuntu 16.10 for Ubuntu 16.04 LTS. It was discovered that a buffer overflow existed in the trace subsystem in the Linux kernel. A privileged local attacker could use this to execute arbitrary code.
9bec1b0c52dba3ff0dfa78ff2a833119b510dbaf89608c58a18e3c7e77a5bcb6Gentoo Linux Security Advisory 201706-11 - A vulnerability in PCRE library allows remote attackers to cause a Denial of Service condition. Versions less than 8.40-r1 are affected.
250d4bd3b61b0522d8ea3153c2e55479fd0cae62f924a217a3dd6988f8609e09Sophos Cyberoam with firmware versions 10.6.4 and below suffer from a cross site scripting vulnerability.
50b3c7902e0d603f5af08aca807d3561adfe90503a0f0a02d2501fb11b1186e3On April 14, 2017, the Shadow Brokers Group released the FUZZBUNCH framework, an exploitation toolkit for Microsoft Windows. The toolkit was allegedly written by the Equation Group, a highly sophisticated threat actor suspected of being tied to the United States National Security Agency (NSA). The framework included ETERNALBLUE, a remote kernel exploit originally targeting the Server Message Block (SMB) service on Microsoft Windows XP (Server 2003) and Microsoft Windows 7 (Server 2008 R2). In this paper, the RiskSense Cyber Security Research team analyzes how using wrong-sized CPU registers leads to a seemingly innocuous mathematical miscalculation. This causes a chain reaction domino effect ultimately culminating in code execution, making ETERNALBLUE one of the most complex exploits ever written. They will discuss what was necessary to port the exploit to Microsoft Windows 10, and future mitigations Microsoft has already deployed, which can prevent vulnerabilities of this class from being exploited in the future. The FUZZBUNCH version of the exploit contains an Address Space Layout Randomization (ASLR) bypass, and the Microsoft Windows 10 version required an additional Data Execution Prevention (DEP) bypass not needed in the original exploit.
fa13189f37eae3318ce25b3bd600e5e83270e401b53f1a2fd4a6340b7b1a8803Robert version 0.5 suffers from cross site request forgery, cross site scripting, remote SQL injection, and directory traversal vulnerabilities.
06c1b0800109e2c1b05c392672ad70281c961a26e7806d968d0bb80cb0568c94
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed