Red Hat Security Advisory 2018-0294-01 - Red Hat JBoss Data Grid is a distributed in-memory data grid, based on Infinispan. This release of Red Hat JBoss Data Grid 7.1.2 serves as a replacement for Red Hat JBoss Data Grid 7.1.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix: A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
9dde4661f9f6e3785fd5b9f5cc17a6e9Advantech WebAccess Node version 8.3.0 suffers from an AspVBObj.dll code execution dll hijacking vulnerability.
d399329ffa7fecc776e24fe1316f6ea9SoapUI suffers from an arbitrary code execution vulnerability via a maliciously imported project.
af94c76942326df1e15c78f2c95be4bcThis Metasploit module attempts to gain root privileges on Linux systems by abusing a vulnerability in the GNU C Library (glibc) dynamic linker. glibc ld.so in versions before 2.11.3, and 2.12.x before 2.12.2 does not properly restrict use of the LD_AUDIT environment variable when loading setuid executables which allows control over the $ORIGIN library search path resulting in execution of arbitrary shared objects. This Metasploit module opens a file descriptor to the specified suid executable via a hard link, then replaces the hard link with a shared object before instructing the linker to execute the file descriptor, resulting in arbitrary code execution. The specified setuid binary must be readable and located on the same file system partition as the specified writable directory. This Metasploit module has been tested successfully on glibc version 2.5 on CentOS 5.4 (x86_64), 2.5 on CentOS 5.5 (x86_64) and 2.12 on Fedora 13 (i386). RHEL 5 is reportedly affected, but untested. Some versions of ld.so hit a failed assertion in dl_open_worker causing exploitation to fail.
e8b55dc3fe5f3080c962d9dabae028c4This Metasploit module attempts to gain root privileges on Linux systems by abusing a vulnerability in the GNU C Library (glibc) dynamic linker. glibc ld.so in versions before 2.11.3, and 2.12.x before 2.12.2 does not properly restrict use of the LD_AUDIT environment variable when loading setuid executables. This allows loading arbitrary shared objects from the trusted library search path with the privileges of the suid user. This Metasploit module uses LD_AUDIT to load the libpcprofile.so shared object, distributed with some versions of glibc, and leverages arbitrary file creation functionality in the library constructor to write a root-owned world-writable file to a system trusted search path (usually /lib). The file is then overwritten with a shared object then loaded with LD_AUDIT resulting in arbitrary code execution. This Metasploit module has been tested successfully on glibc version 2.11.1 on Ubuntu 10.04 x86_64 and version 2.7 on Debian 5.0.4 i386. RHEL 5 is reportedly affected, but untested. Some glibc distributions do not contain the libpcprofile.so library required for successful exploitation.
2bf9e1106acf9e1f0a7b618fe7f2da3fSchools Alert Management Script version 2.0.2 suffers from code execution and remote file upload vulnerabilities.
e9f0ef105c5c61f02c39346e049324cbFisheye and Crucible suffer from a remote code execution vulnerability through OGNL double evaluation. Versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability.
556b833c5e261bcfc86a761471ef339aDebian Linux Security Advisory 4105-1 - It was discovered that mpv, a media player, was vulnerable to remote code execution attacks. An attacker could craft a malicious web page that, when used as an argument in mpv, could execute arbitrary code in the host of the mpv user.
bfcbda579d18140ffb85913b522a3969Adobe Coldfusion version 11.0.03.292866 BlazeDS java object deserialization remote code execution exploit.
46942c29e2b6e97ace05a01a10b9e844Kaspersky Secure Mail Gateway version 1.1.0.379 suffers from code execution and cross site request forgery vulnerabilities.
04398c48a2c352c40a07dcb4a1897e4fThis Metasploit module will exploit SMB with vulnerabilities in MS17-010 to achieve a write-what-where primitive. This will then be used to overwrite the connection session information with as an Administrator session. From there, the normal psexec payload code execution is done. Exploits a type confusion between Transaction and WriteAndX requests and a race condition in Transaction requests, as seen in the EternalRomance, EternalChampion, and EternalSynergy exploits. This exploit chain is more reliable than the EternalBlue exploit, but requires a named pipe.
c27d241cdd1403cb7b771afeb66ed3d1This Metasploit module attempts to gain root privileges on Linux systems by invoking the default coredump handler inside a namespace ("container"). Apport versions 2.13 through 2.17.x before 2.17.1 on Ubuntu are vulnerable, due to a feature which allows forwarding reports to a container's Apport by changing the root directory before loading the crash report, causing 'usr/share/apport/apport' within the crashed task's directory to be executed. Similarly, Fedora is vulnerable when the kernel crash handler is configured to change root directory before executing ABRT, causing 'usr/libexec/abrt-hook-ccpp' within the crashed task's directory to be executed. In both instances, the crash handler does not drop privileges, resulting in code execution as root. This Metasploit module has been tested successfully on Apport 2.14.1 on Ubuntu 14.04.1 LTS x86 and x86_64 and ABRT on Fedora 19 and 20 x86_64.
1dc9fd5c90665c8934d2712e757240c3HP Security Bulletin HPESBHF03815 1 - A security vulnerability in HPE Intelligent Management Center (iMC) PLAT can be exploited to allow remote code execution. This is an enhanced fix for ZDI-17-162/CVE-2017-5792. Revision 1 of this advisory.
b10eaa284036f9380d2173f7eaf55928HP Security Bulletin HPESBHF03813 1 - A security vulnerability has been identified in IMC PLAT 7.3 E0506. The vulnerability could be remotely exploited to allow remote code execution. This is an enhanced fix to ZDI-17-484. Revision 1 of this advisory.
781a30fce34fda7a3de7587902067ae4HP Security Bulletin HPESBHF03808 1 - A security vulnerability has been identified in HPE Intelligent Management Center (iMC) PLAT 7.3 E0504P04. The vulnerability could be exploited to allow remote code execution. Revision 1 of this advisory.
fbb1672b423522ffa369e201461309c1The Oracle WebLogic WLS WSAT component is vulnerable to an XML deserialization remote code execution vulnerability. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0.
2daa838b9b2485cace670442af754ec5Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a dlp_policy_upload.cgi remote code execution vulnerability.
f56935b7186a1bb0e06c683d70145e04BMC Track-It! version 11.4 suffers from remote code execution and credential disclosure vulnerabilities.
d6507459a64e274eb19ea9d09ebbf627WebKitGTK+ versions 2.18.x suffer from various memory corruption, user interface spoofing, and code execution vulnerabilities.
56c7ac8a62544bdad2da9c56c5aff379AsusWRT Router versions prior to 3.0.0.4.380.7743 suffer from an unauthenticated LAN remote code execution vulnerability.
76e861a72a3ce836f6c0b5f6dc36b004Exodus Wallet (ElectronJS Framework) suffers from a remote code execution vulnerability.
b982f016d2e962c8afe4d2c5d3b8ef58Apple Security Advisory 2018-1-23-7 - iCloud for Windows 7.3 is now available and addresses code execution vulnerabilities.
7f66fa9c1925323303df6c448d12a4cfApple Security Advisory 2018-1-23-6 - iTunes 12.7.3 for Windows is now available and addresses code execution vulnerabilities.
c0add0de73417e236e8ffa65303d38e2Apple Security Advisory 2018-1-23-5 - Safari 11.0.3 is now available and addresses code execution vulnerabilities.
dc67c97b8e9f79cb0401d77349c4c516Apple Security Advisory 2018-1-23-4 - tvOS 11.2.5 is now available and addresses code execution vulnerabilities.
f746122d24524e02f79d1ddd41829a68
© 2018 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed