#Java se development kit 10 vs 8u152 code

Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets. It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets. It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. An attacker could use a combination of 'Just in Time' Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets. This could lead to a crash of the GnuTLS server application.Ī cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function. Procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. Procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. Procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service). Procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow.

#Java se development kit 10 vs 8u152 code

This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users. Procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.Īrm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka 'straight-line speculation.'

A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.Ī race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. Versions through v240 are vulnerable.Ī buffer overflow was discovered in Load_SBit_Png. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.Īn allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.Īn allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog.