2018

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() mac

An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header exten

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL

An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback en

ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows local users to achieve partial plaintext recovery (fo

ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recover

A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client

A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; t

A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to

It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.

It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 fo

It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for

It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of

It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling

A missing patch for a stack-based buffer overflow in findTable() was found in Red Hat version of liblouis before 2.5.4.

Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker with access to th

A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker coul

It was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used th

An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This fla

A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the

It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially us

Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds

A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An

A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/trans

An out-of-bounds heap buffer read flaw was found in the way advancecomp before 2.1-2018/02 handled processing of ZIP fil

JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload. A malformed XML file, i

JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw

It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data

A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead

jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send ema

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, t

An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server c

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD)

It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user syste

It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a serie

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages

An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a ser

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the

A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the

A memory allocation vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the appli

A null pointer dereference vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause th

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the applic

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the applic

An out-of-bounds read vulnerability was found in netpbm before 10.61. The expandCodeOntoStack() function has an insuffic

A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A loca

The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. I

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only