#microsoft

CVE-2021-32762: Integer overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platforms

Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14.

3 years ago

CVE

Open in Source

#vulnerability #microsoft #redis

CVE-2021-37976: Chromium: CVE-2021-37976 Information leak in core

*What is the version information for this release?* Microsoft Edge Version Date Released Based on Chromium Version 94.0.992.38 10/01/2021 94.0.4606.71

3 years ago

Microsoft Security Response Center

Open in Source

#Microsoft Edge (Chromium-based)#Security Vulnerability #microsoft

CVE-2021-37975: Chromium: CVE-2021-37975 Use after free in V8

*What is the version information for this release?* Microsoft Edge Version Date Released Based on Chromium Version 94.0.992.38 10/01/2021 94.0.4606.71

3 years ago

Microsoft Security Response Center

Open in Source

#Microsoft Edge (Chromium-based)#Security Vulnerability #microsoft

CVE-2021-37974: Chromium: CVE-2021-37974 Use after free in Safe Browsing

*What is the version information for this release?* Microsoft Edge Version Date Released Based on Chromium Version 94.0.992.38 10/01/2021 94.0.4606.71

3 years ago

Microsoft Security Response Center

Open in Source

#Microsoft Edge (Chromium-based)#Security Vulnerability #microsoft

Microsoft, CISA and NSA offer security tools and advice, but will you take it?

Microsoft, CISA, and the NSA are individually offering tools and advice that aim to improve security for organizations. But will the targeted audience have the time and resources to accept that help? Categories: Opinion Tags: cisa EM emergency mitigation service EOL exchange insider risk mitigation self-assessment tool insider threat microsoft NSA nss supply chain attack vpn *( Read more... ( https://blog.malwarebytes.com/opinion/2021/09/microsoft-cisa-and-nsa-offer-orgs-security-tools-and-advice-but-will-those-that-need-it-the-most-be-the-ones-that-use-it/ ) )* The post Microsoft, CISA and NSA offer security tools and advice, but will you take it? appeared first on Malwarebytes Labs.

3 years ago

Malwarebytes

Open in Source