memcached: Server append/prepend remote code execution

An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

kernel: Integer overflow in the RDMA over infiniband software implementation

Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the "RDMA protocol over infiniband" (aka Soft RoCE) technology.

tcpdump: multiple overflow issues in protocol decoding

The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2017-5482.

tcpdump: multiple overflow issues in protocol decoding

The FRF.15 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:frf15_print().

tcpdump: multiple overflow issues in protocol decoding

The Classical IP over ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-cip.c:cip_if_print().

An issue was discovered in Siemens ETA4 firmware (all versions prior to Revision 08) of the SM-2558 extension module for: SICAM AK, SICAM TM 1703, SICAM BC 1703, and SICAM AK 3. Specially crafted packets sent to Port 2404/TCP could cause the affected device to go into defect mode. A cold start might be required to recover the system, a Denial-of-Service Vulnerability.

tcpdump: multiple overflow issues in protocol decoding

A bug in util-print.c:relts_print() in tcpdump before 4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM).

tcpdump: multiple overflow issues in protocol decoding

The GeoNetworking parser in tcpdump before 4.9.0 has a buffer overflow in print-geonet.c, multiple functions.

tcpdump: multiple overflow issues in protocol decoding

The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print().

tcpdump: multiple overflow issues in protocol decoding

The TFTP parser in tcpdump before 4.9.0 has a buffer overflow in print-tftp.c:tftp_print().

tcpdump: multiple overflow issues in protocol decoding

The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print().

tcpdump: multiple overflow issues in protocol decoding

The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcp_print().

autotrace: Multiple security issues

libautotrace.a in AutoTrace 0.31.1 has a "negative-size-param" issue in the ReadImage function in input-tga.c:528:7.

tcpdump: multiple overflow issues in protocol decoding

The IP parser in tcpdump before 4.9.0 has a buffer overflow in print-ip.c, multiple functions.

tcpdump: multiple overflow issues in protocol decoding

The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions.

autotrace: Multiple security issues

libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:498:55.

kernel: Integer overflow in the qla2x00_sysfs_write_optrom_ctl function

An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access.

tcpdump: multiple overflow issues in protocol decoding

The STP parser in tcpdump before 4.9.0 has a buffer overflow in print-stp.c, multiple functions.

autotrace: Multiple security issues

libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:508:18.

tcpdump: multiple overflow issues in protocol decoding

The GRE parser in tcpdump before 4.9.0 has a buffer overflow in print-gre.c, multiple functions.