Today on Tuesday 2017-04-11, Microsoft announced its monthly security release (also known as Patch Tuesday). Reviewing Microsofts Security Update Guide, it looks like theres 644 updates with 210 of them listed as Critical severity. Release notes are here. Details can be found here. The highest profile issue from this set of updates invovles CVE-2017-0199. This …
Read more “April 2017 Microsoft Patch Tuesday, (Tue, Apr 11th)”
Today on Tuesday 2017-04-11, Microsoft announced its monthly security release (also known as Patch Tuesday). Reviewing Microsofts Security Update Guide, it looks like theres 644 updates with 210 of them listed as Critical severity. Release notes are here. Details can be found here. Im currently working on the patch summary, which you can access here: …
Read more “April 2017 Microsoft Patch Tuesday, (Tue, Apr 11th)”
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.
** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states “I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser.”
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
The TMM SSO plugin in F5 BIG-IP APM 12.0.0 – 12.1.1, 11.6.0 – 11.6.1 HF1, 11.5.4 – 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider (SP) connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an authenticated user is sent via …
Blue Coat SSL Visibility (SSLV) 3.x before 3.11.3.1 is susceptible to a denial-of-service vulnerability that impacts the SSL servers for intercepted SSL connections. A malicious SSL client can, under certain circumstances, temporarily exhaust the TCP connection pool of an SSL server.
SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via crafted MSDOS partition table with an extended partition boot record at zero offset.