Debian Security Update - Php5

Debian Security Update - php5

AlienVault ID: ENG-107845 Description: An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process. CVE ID: CVE-2018-10545 CVSS: 3.7

Debian Security Update - php5

AlienVault ID: ENG-107845 Description: An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences. CVE ID: CVE-2018-10546 CVSS: 3.7

Debian Security Update - php5

AlienVault ID: ENG-107845 Description: An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712. CVE ID: CVE-2018-10547 CVSS: 3.2

Debian Security Update - php5

AlienVault ID: ENG-107845 Description: An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn return value. CVE ID: CVE-2018-10548 CVSS: 3.7

Debian Security Update - php5

AlienVault ID: ENG-107845 Description: An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exif_read_data in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exif_iif_add_value mishandles the case of a MakerNote that lacks a final '\0' character. CVE ID: CVE-2018-10549 CVSS: 5.0

Debian Security Update - php5

AlienVault ID: ENG-107845 Description: In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string. CVE ID: CVE-2018-7584 CVSS: 6.2

Debian Security Update - libgcrypt20

AlienVault ID: ENG-107857 Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. CVE ID: CVE-2018-0495 CVSS: 1.4

Debian Security Update - tiff

AlienVault ID: ENG-107838 Description: In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer. CVE ID: CVE-2017-11613 CVSS: 4.3

Debian Security Update - tiff

AlienVault ID: ENG-107838 Description: The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726.= CVE ID: CVE-2018-10963 CVSS: 4.3

Debian Security Update - tiff

AlienVault ID: ENG-107838 Description: In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries. CVE ID: CVE-2018-5784 CVSS: 4.3

Debian Security Update - tiff

AlienVault ID: ENG-107838 Description: A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.) CVE ID: CVE-2018-7456 CVSS: 4.3

Debian Security Update - tiff

AlienVault ID: ENG-107838 Description: In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps.\ CVE ID: CVE-2018-8905 CVSS: 5.0

Debian Security Update - libsoup2.4

AlienVault ID: ENG-107846 Description: The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname CVE ID: CVE-2018-12910 CVSS: 6.4

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. CVE ID: CVE-2017-5715 CVSS: 4.2

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. CVE ID: CVE-2017-5753 CVSS: 4.2

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: ** DISPUTED ** Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it "virtually impossible to exploit." CVE ID: CVE-2018-1000204 CVSS: 6.3

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery. CVE ID: CVE-2018-1066 CVSS: 5.9

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest. CVE ID: CVE-2018-10853 CVSS: RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers. CVE ID: CVE-2018-1093 CVSS: 5.3

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory. CVE ID: CVE-2018-10940 CVSS: AlienVault Note: Not affected.

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of certain crafted system calls. CVE ID: CVE-2018-1130 CVSS: 3.6

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call. CVE ID: CVE-2018-11506 CVSS: 5.3

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr. CVE ID: CVE-2018-12233 CVSS: AlienVault Note: Not affected.

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device. CVE ID: CVE-2018-3665 CVSS: 4.7

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets. CVE ID: CVE-2018-5814 CVSS: 5.1

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-107854 Description: RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Alienvault Note: You need a local user, but the local user in the USM appliance systems is root. CVE ID: CVE-2018-9422 CVSS: —

Debian Security Update - mysql-5.5

AlienVault ID: ENG-106318 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N). CVE ID: CVE-2017-10268 CVSS: AlienVault Note: This vulnerability is for mysql-server component. It is not installed on the USM appliance.

Debian Security Update - mysql-5.5

AlienVault ID: ENG-106318 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.11 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE ID: CVE-2017-10378 CVSS: AlienVault Note: This vulnerability is for mysql-server component. It is not installed on the USM appliance.

Debian Security Update - mysql-5.5

AlienVault ID: ENG-106318 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). CVE ID: CVE-2017-10379 CVSS: AlienVault Note: This vulnerability is for mysql-server component. It is not installed on the USM appliance.

Debian Security Update - mysql-5.5

AlienVault ID: ENG-106318 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.57 and earlier 5.6.37 and earlier 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE ID: CVE-2017-10384 CVSS: AlienVault Note: This vulnerability is for mysql-server component. It is not installed on the USM appliance.

Debian Security Update - curl

AlienVault ID: ENG-106346 Description: An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded. CVE ID: CVE-2017-1000257 CVSS: 6.4

Debian Security Update - wget

AlienVault ID: ENG-106347 Description: The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. CVE ID: CVE-2017-13089 CVSS: 6.3

Debian Security Update - wget

AlienVault ID: ENG-106347 Description: The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer. CVE ID: CVE-2017-13090 CVSS: 6.3

Debian Security Update - openssl

AlienVault ID: ENG-106400 Description: While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g. CVE ID: CVE-2017-3735 CVSS: 5.0

Debian Security Update - libxml-libxml-perl

AlienVault ID: ENG-106453 Description: Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call. CVE ID: CVE-2017-10672 CVSS: 4.8

Debian Security Update - samba

AlienVault ID: ENG-106474 Description: Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request. CVE ID: CVE-2017-14746 CVSS: Alienvault Note: This vulnerability only affects the samba server. The USM Appliance is not affected.

Debian Security Update - samba

AlienVault ID: ENG-106474 Description: Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory. CVE ID: CVE-2017-15275 CVSS: This vulnerability only affects the samba server. The USM Appliance is not affected.

Debian Security Update - curl

AlienVault ID: ENG-106504 Description: The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields. CVE ID: CVE-2017-8816 CVSS: 5.5

Debian Security Update - curl

AlienVault ID: ENG-106504 Description: The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character. CVE ID: CVE-2017-8817 CVSS: 5.5

Debian Security Update - libXcursor

AlienVault ID: ENG-106809 Description: libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0. CVE ID: CVE-2017-16612 CVSS: 3.0

Debian Security Update - Wireshark

AlienVault ID: ENG-106877 Description: In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection. CVE ID: CVE-2017-11408 CVSS: 3.7

Debian Security Update - Wireshark

AlienVault ID: ENG-106877 Description: In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. This was addressed in epan/dissectors/packet-netbios.c by ensuring that write operations are bounded by the beginning of a buffer. CVE ID: CVE-2017-17083 CVSS: 3.7

Debian Security Update - Wireshark

AlienVault ID: ENG-106877 Description: In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARP_MPA dissector could crash. This was addressed in epan/dissectors/packet-iwarp-mpa.c by validating a ULPDU length. CVE ID: CVE-2017-17084 CVSS: 3.7

Debian Security Update - Wireshark

AlienVault ID: ENG-106877 Description: In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/dissectors/packet-cipsafety.c by validating the packet length. CVE ID: CVE-2017-17085 CVSS: 3.7

Debian Security Update - rsync

AlienVault ID: ENG-106653 Description: The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon. CVE ID: CVE-2017-16548 CVSS: 5.5

Debian Security Update - rsync

AlienVault ID: ENG-106653 Description: The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions. CVE ID: CVE-2017-17433 CVSS: 5.5

Debian Security Update - rsync

AlienVault ID: ENG-106653 Description: The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions. CVE ID: CVE-2017-17434 CVSS: 5.5

Debian Security Update - sensible-utils

AlienVault ID: ENG-106651 Description: sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument. CVE ID: CVE-2017-17512 CVSS: 5.0

Debian Security Update - php5

AlienVault ID: ENG-106654 Description: In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c. CVE ID: CVE-2017-11142 CVSS: 5.8

Debian Security Update - php5

AlienVault ID: ENG-106654 Description: In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c. CVE ID: CVE-2017-11143 CVSS: 5.5

Debian Security Update - php5

AlienVault ID: ENG-106654 Description: In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission. CVE ID: CVE-2017-11144 CVSS: 3.7

Debian Security Update - php5

AlienVault ID: ENG-106654 Description: In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: the correct fix is in the e8b7698f5ee757ce2c8bd10a192a491a498f891c commit, not the bd77ac90d3bdf31ce2a5251ad92e9e75 gist. CVE ID: CVE-2017-11145 CVSS: 3.7

Debian Security Update - php5

AlienVault ID: ENG-106654 Description: In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives. CVE ID: CVE-2017-11628 CVSS: 4.4

Debian Security Update - php5

AlienVault ID: ENG-106654 Description: The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP. CVE ID: CVE-2017-12933 CVSS: 5.5

Debian Security Update - php5

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-106656 Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. CVE ID: CVE-2017-1000407 CVSS: 4.5

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-106656 Description: The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. By manipulating the code flows that precede the handling of these configuration messages, an attacker can also gain some control over which data will be held in the uninitialized stack variables. This can allow him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in this manner. Combining this vulnerability (for example) with the previously disclosed RCE vulnerability in L2CAP configuration parsing (CVE-2017-1000251) may allow an attacker to exploit the RCE against kernels which were built with the above mitigations. These are the specifics of this vulnerability: In the function l2cap_parse_conf_rsp and in the function l2cap_parse_conf_req the following variable is declared without initialization: struct l2cap_conf_efs efs; In addition, when parsing input configuration parameters in both of these functions, the switch case for handling EFS elements may skip the memcpy call that will write to the efs variable: ... case L2CAP_CONF_EFS: if (olen == sizeof(efs)) memcpy(&efs, (void *)val, olen); ... The olen in the above if is attacker controlled, and regardless of that if, in both of these functions the efs variable would eventually be added to the outgoing configuration request that is being built: l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), (unsigned long) &efs); So by sending a configuration request, or response, that contains an L2CAP_CONF_EFS element, but with an element length that is not sizeof(efs) - the memcpy to the uninitialized efs variable can be avoided, and the uninitialized variable would be returned to the attacker (16 bytes). CVE ID: CVE-2017-1000410 CVSS: 3.7

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-106656 Description: The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows local users to gain privileges via a crafted application. CVE ID: CVE-2017-15868 CVSS: 5.3

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-106656 Description: drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner). CVE ID: CVE-2017-16538 CVSS: 5.3

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-106656 Description: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages. CVE ID: CVE-2017-16939 CVSS: 5.3

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-106656 Description: net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces. CVE ID: CVE-2017-17448 CVSS: 3.4

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-106656 Description: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system. CVE ID: CVE-2017-17449 CVSS: 1.4

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-106656 Description: The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device. CVE ID: CVE-2017-17558 CVSS: 5.3

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-106656 Description: The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code and gain privileges. CVE ID: CVE-2017-17741 CVSS: 1.6

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-106656 Description: The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization. CVE ID: CVE-2017-17806 CVSS: 5.3

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-106656 Description: The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via the request_key() system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c. CVE ID: CVE-2017-17807 CVSS: 1.6

Debian Security Update - Linux(Kernel)

AlienVault ID: ENG-106656 Description: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state. CVE ID: CVE-2017-8824 CVSS: 5.3

Debian Security Update - libxml2

AlienVault ID: ENG-106660 Description: RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE ID: CVE-2017-15412 CVSS: —

Debian Security Update - gdk-pixbuf

AlienVault ID: ENG-106808 Description: Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution. CVE ID: CVE-2017-1000422 CVSS: 6.0

Debian Security Update - mysql-5.5

AlienVault ID: ENG-106683 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.19 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data CVE ID: CVE-2018-2562 CVSS: 7.5

Debian Security Update - mysql-5.5

AlienVault ID: ENG-106683 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE ID: CVE-2018-2622 CVSS: 6.8

Debian Security Update - mysql-5.5

AlienVault ID: ENG-106683 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE ID: CVE-2018-2640 CVSS: 6.8

Debian Security Update - mysql-5.5

Debian Security Update - curl

AlienVault ID: ENG-106716 Description: libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something. CVE ID: CVE-2018-1000005 CVSS: 4.7

Debian Security Update - curl

AlienVault ID: ENG-106716 Description: libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequest hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request. CVE ID: CVE-2018-1000007 CVSS: 5.0

Debian Security Update - tiff

AlienVault ID: ENG-106722 Description: There is a heap based buffer overflow in tools/tiff2pdf.c of LibTIFF 4.0.8 via a PlanarConfig=Contig image, which causes a more than one hundred bytes out-of-bounds write (related to the ZIPDecode function in tif_zip.c). A crafted input may lead to a remote denial of service attack or an arbitrary code execution attack. CVE ID: CVE-2017-11335 CVSS: 5.0

Debian Security Update - tiff

AlienVault ID: ENG-106722 Description: LibTIFF 4.0.7 allows remote attackers to cause a denial of service The TIFFReadDirEntryArray function in tif_read.c in LibTIFF 4.0.8 mishandles memory allocation for short files, which allows remote attackers to cause a denial of service (allocation failure and application crash) in the TIFFFetchStripThing function in tif_dirread.c during a tiff2pdf invocation. CVE ID: CVE-2017-12944 CVSS: 3.7

Debian Security Update - tiff

AlienVault ID: ENG-106722 Description: There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack. CVE ID: CVE-2017-13726 CVSS: 3.2

Debian Security Update - tiff

AlienVault ID: ENG-106722 Description: There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack. CVE ID: CVE-2017-13727 CVSS: 3.2

Debian Security Update - tiff

AlienVault ID: ENG-106722 Description: In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash. CVE ID: CVE-2017-18013 CVSS: 3.2

Debian Security Update - tiff

AlienVault ID: ENG-106722 Description: In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given these possibilities, it probably could cause arbitrary code execution. CVE ID: CVE-2017-9935 CVSS: 5.0

Debian Security Update - wireshark

AlienVault ID: ENG-106721 Description: In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by correcting the signature timestamp bounds checks. CVE ID: CVE-2018-5334 CVSS: 3.2

Debian Security Update - wireshark

AlienVault ID: ENG-106721 Description: In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash. This was addressed in epan/dissectors/packet-wcp.c by validating the available buffer length. CVE ID: CVE-2018-5335 CVSS: 4.3

Debian Security Update - wireshark

Debian Security Update - squid3

AlienVault ID: ENG-106888 Description: The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later. CVE ID: CVE-2018-1000024 CVSS: 5.0

Debian Security Update - squid3

AlienVault ID: ENG-106888 Description: The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later. CVE ID: CVE-2018-1000027 CVSS: 2.9

Debian Security Update - iso-dhcp

AlienVault ID: ENG-106937 Description: This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE ID: CVE-2017-3144 CVSS: —

Debian Security Update - iso-dhcp

Debian Security Update - curl

AlienVault ID: ENG-106943 Description: A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. CVE ID: CVE-2018-1000120 CVSS: 7.5

Debian Security Update - curl

AlienVault ID: ENG-106943 Description: A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service CVE ID: CVE-2018-1000121 CVSS: 5.0

Debian Security Update - curl

AlienVault ID: ENG-106943 Description: A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage CVE ID: CVE-2018-1000122 CVSS: 4.9

Debian Security Update - icu

AlienVault ID: ENG-106980 Description: Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. CVE ID: CVE-2017-15422 CVSS: —

Vulnerable Debian Package - net-snmp

AlienVault ID: ENG-107138 Description: The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet. CVE ID CVE-2015-5621 CVSS: 7.5

Vulnerable Debian Package - net-snmp

AlienVault ID: ENG-107138 Description: NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP protocol handler that can result in command execution. CVE ID CVE-2018-1000116 CVSS: 7.5

Vulnerable Debian Package - openssl

AlienVault ID: ENG-107012 Description: Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n). CVE ID CVE-2018-0739 CVSS: 2.9

Vulnerable Debian Package - apache2

AlienVault ID: ENG-107018 Description: In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all. CVE ID CVE-2017-15710 CVSS: 3.6

Vulnerable Debian Package - apache2

AlienVault ID: ENG-107018 Description: In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename. CVE ID CVE-2017-15715 CVSS: 5.0

Vulnerable Debian Package - apache2

AlienVault ID: ENG-107018 Description: In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications. CVE ID CVE-2018-1283 CVSS: 3.5

Vulnerable Debian Package - apache2

AlienVault ID: ENG-107018 Description: A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage. CVE ID CVE-2018-1301 CVSS: 4.3

Vulnerable Debian Package - apache2

AlienVault ID: ENG-107018 Description: A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability. CVE IDCVE-2018-1303 CVSS: 5.0

Vulnerable Debian Package - apache2

AlienVault ID: ENG-107018 Description: In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo- random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection. CVE IDCVE-2018-1312 CVSS: 6.8

Vulnerable Debian Package - perl

AlienVault ID: ENG-107082 Description: Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count. CVE ID CVE-2018-6913 CVSS: 7.5

Vulnerable Debian Package - mysql

AlienVault ID: ENG-107122 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVE ID CVE-2018-2755 CVSS: 3.7

Vulnerable Debian Package - mysql

AlienVault ID: ENG-107122 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE ID CVE-2018-2761 CVSS: 2.9

Vulnerable Debian Package - mysql

AlienVault ID: ENG-107122 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Locking). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE ID CVE-2018-2771 CVSS: 2.9

Vulnerable Debian Package - mysql

AlienVault ID: ENG-107122 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE ID CVE-2018-2773 CVSS: 1.9

Vulnerable Debian Package - mysql

AlienVault ID: ENG-107122 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE ID CVE-2018-2781 CVSS: 4.0

Vulnerable Debian Package - mysql

AlienVault ID: ENG-107122 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVE ID CVE-2018-2813 CVSS: 2.9

Vulnerable Debian Package - mysql

AlienVault ID: ENG-107122 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE ID CVE-2018-2817 CVSS: 4.0

Vulnerable Debian Package - mysql

AlienVault ID: ENG-107122 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE ID CVE-2018-2818 CVSS: 4.0

Debian Security Update

AlienVault ID: ENG-107122 Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE ID: CVE-2018-2819 CVSS: 4.0

Vulnerable Debian Package - Linux (Kernel)

AlienVault ID: ENG-107263 Description: In blk_mq_tag_to_rq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been previously freed by blk_mq_complete_request. This could lead to local escalation of privilege. Product: Android. Versions: Android kernel. Android ID: A-63083046. CVE ID CVE-2015-9016 CVSS: 6.9

Vulnerable Debian Package - Linux (Kernel)

AlienVault ID: ENG-107263 Description: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors. CVE ID CVE-2017-0861 CVSS: 4.6

Vulnerable Debian Package - Linux (Kernel)

AlienVault ID: ENG-107263 Description: An elevation of privilege vulnerability in the kernel v4l2 video driver. Product: Android. Versions: Android kernel. Android ID A-34624167. CVE ID CVE-2017-13166 CVSS: 4.6

Vulnerable Debian Package - Linux (Kernel)

AlienVault ID: ENG-107263 Description: An elevation of privilege vulnerability in the Upstream kernel bluez. Product: Android. Versions: Android kernel. Android ID: A-63527053. CVE ID CVE-2017-13220 CVSS: 4.6

Vulnerable Debian Package - Linux (Kernel)

AlienVault ID: ENG-107263 Description: drivers/uwb/uwbd.c in the Linux kernel before 4