Arbitrary Code Execution

Overview grunt is a JavaScript task runner. Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML. Remediation Upgrade grunt to version...

UBUNTU-CVE-2020-15704

The modprobe child process in the ./debian/patches/loadpppgenericifneeded patch file incorrectly handled module loading. A local non-root attacker could exploit the MODPROBEOPTIONS environment variable to read arbitrary root files. Fixed in 2.4.5-5ubuntu1.4, 2.4.5-5.1ubuntu2.3+esm2,...

USN-4440-1 linux-hwe, linux-aws-5.3, linux-azure-5.3, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-oracle-5.3, linux-raspi2-5.3 vulnerabilities

It was discovered that the network block device nbd implementation in the Linux kernel did not properly check for error conditions in some situations. An attacker could possibly use this to cause a denial of service system crash. CVE-2019-16089 It was discovered that the kernel-user space relay...

Important: Red Hat Bug Fix Advisory: Satellite 6.7.2 Async Bug Fix Update

Updated Satellite 6.7 packages that fix several bugs are now available for Red Hat Satellite. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other clien...

Arbitrary Code Execution

Overview shiba is a Live markdown previewer with linter Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad. Remediation There is no fixed version for shiba...

Arbitrary Code Execution

Overview jingo is a git based wiki engine written for node.js, with a decent design, a search capability and a good typography. Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function yaml.load of the package js-yaml instead of its...

OSV-2020-1481 Heap-buffer-overflow in load_encoded_method

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6402 Crash type: Heap-buffer-overflow READ 4 Crash state: loadencodedmethod dexparse dexload...

OSV-2020-1474 Heap-buffer-overflow in dotnet_parse_com

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8901 Crash type: Heap-buffer-overflow READ 8 Crash state: dotnetparsecom dotnetload yrmodulesload...

OSV-2020-1464 Heap-buffer-overflow in dotnet_parse_com

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8901 Crash type: Heap-buffer-overflow READ 12 Crash state: dotnetparsecom dotnetload yrmodulesload...

PT-2020-21876

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash occurs in the load jpeg image function, which calls stbi jpeg load and then stbi load main...

PT-2020-6744

Name of the Vulnerable Software and Affected Versions Mozilla Firefox for iOS versions prior to 28 Description The issue is related to insufficient access control in the WKUserScript function used for loading in Mozilla Firefox for iOS. This could allow a remote attacker to load arbitrary files. ...

PT-2020-21878

Name of the Vulnerable Software and Affected Versions HDF5 affected versions not specified Description The issue is related to a crash that occurs due to a segmentation fault on an unknown address. Technical details about the crash include the involvement of specific function calls: H5O chunk...

PT-2020-21852

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read crash. Technical details include a crash type of Heap-buffer-overflow READ 16, with a crash state...

PT-2020-21875

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details include the crash type being a Heap-buffer-overflow READ 8, and the crash stat...

PT-2020-21801

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves several functions and files, including psscan, document load,...

PT-2020-21747

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves several functions: readline, psscan, and document load. No information is available about the...

PT-2020-21771

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves functions such as ps read doseps, psscan, and document load. N...

PT-2020-21655

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions: exif mnote data olympus load, exif data load data, and ex...

CVE-2020-15801

In Python 3.8.4, sys.path restrictions specified in a python38.pth file are ignored, allowing code to be loaded from arbitrary locations. The .pth file e.g., the python.pth file is not affected...

PYSEC-2020-14

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler depending o...