by CIRT Team
Multiple Dell EMC Products CVE-2018-1239 Multiple Remote Command Injection Vulnerabilities
Description: Multiple Dell EMC Products are prone to multiple remote command-injection vulnerabilities. Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. Impact: A remote application admin user could potentially exploit the vulnerabilities to execute arbitrary OS commands as system root on the system where Dell EMC Unity is installed. Mitigation: Updates are available. Please see the...
Read More
by CIRT Team
Apple Swift CVE-2018-4220 Arbitrary Code Execution Vulnerability
Description: Apple Swift is prone to an arbitrary code-execution vulnerability. Impact: A remote attacker may exploit this issue to execute arbitrary code in the context of the affected application. Failed attempts will likely cause a denial-of-service condition. Mitigation: Updates are available. Please see the references or vendor advisory for more information. Reference URL’s: https://support.apple.com/en-us/HT208804 https://lists.apple.com/archives/security-announce/2018/May/msg00000.html https://www.securityfocus.com/bid/104085/info https://swift.org/
by CIRT Team
Multiple Devices Integrated GPUs CVE-2018-10229 Security Bypass Vulnerability
Description: A hardware vulnerability in GPU memory modules allows attackers to accelerate micro-architectural attacks through the use of the JavaScript WebGL API. Impact: Upon visiting a malicious or compromised website with a vulnerable device, an attacker may be able to bypass security features provided by the web browser. Mitigation: Apply an update. Google Chrome and Mozilla Firefox have released updates which disable high precision timers...
Read More
by CIRT Team
Critical Alert: Multiple Vulnerabilities in Google Android OS Could Allow for Arbitrary Code Execution
Description: Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for arbitrary code execution within the context of a privileged process. Details of these vulnerabilities are as follows: * An information disclosure vulnerability in Android runtime. (CVE-2017-13309) * Multiple elevation of privilege vulnerabilities in Framework. (CVE-2017-13310, CVE-2017-13311) * Multiple information disclosure vulnerabilities in Kernel components. (CVE-2017-16643, CVE-2017-5754) *...
Read More
by CIRT Team
QEMU CVE-2017-15124 Denial of Service Vulnerability
Description: VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to...
Read More
by CIRT Team
OpenStack Nova CVE-2017-18191 Local Denial of Service Vulnerability
Description: An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses...
Read More
by CIRT Team
Xen ‘xen/common/grant_table.c’ Denial of Service Vulnerability (CVE-2018-7541)
Description: An issue was discovered in Xen through 4.10.x allowing guest OS users to cause a denial of service (hypervisor crash) or gain privileges by triggering a grant-table transition from v2 to v1. Impact: An attacker can exploit this issue to crash the host, denying service to legitimate users. Xen 4.0 and later are vulnerable. Mitigation: Updates are available. Please see the references or vendor...
Read More
by CIRT Team
Remote Control Vulnerability in RCS Module of Some Huawei Smart Phones (CVE-2018-7901)
Description: RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions earlier than 8.0.0.129 has a remote-control vulnerability. An attacker can trick a user to install a malicious application. When the application connects with RCS for the first time, it needs user to manually click to agree. In addition, the attacker needs to obtain the key...
Read More
by CIRT Team
Memory double free vulnerability on Huawei smartphones (CVE-2017-17320)
Description: Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability. The system does not manage the memory properly, that frees on the same memory address twice. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could result in malicious code execution. Impact: An attacker tricks the user who has root...
Read More
by CIRT Team
Microsoft Releases Critical Security Updates
Description: A remote code execution vulnerability exists when the Windows Host Compute Service Shim (hcsshim) library fails to properly validate input while importing a container image. To exploit the vulnerability, an attacker would place malicious code in a specially crafted container image which, if an authenticated administrator imported (pulled), could cause a container management service utilizing the Host Compute Service Shim library to execute malicious...
Read More
