[SECURITY] Fedora 32 Update: chrony-3.5.1-1.fc32

chrony is a versatile implementation of the Network Time Protocol NTP. It can synchronise the system clock with NTP servers, reference clocks e.g. GPS receiver, and manual input using wristwatch and keyboard. It can also operate as an NTPv4 RFC 5905 server and peer to provide a time service to...

[SECURITY] Fedora 31 Update: nspr-4.26.0-1.fc31

NSPR provides platform independence for non-GUI operating system facilities. These facilities include threads, thread synchronization, normal file and network I/O, interval timing and calendar time, basic memory management malloc and free and shared library linking...

FreeBSD ip6_setpktopt Use-After-Free Privilege Escalation Exploit

This Metasploit module exploits a race and use-after-free vulnerability in the FreeBSD kernel IPv6 socket handling. A missing synchronization lock in the IPV62292PKTOPTIONS option handling in setsockopt permits racing ip6setpktopt access to a freed ip6pktopts struct. This exploit overwrites the...

EulerOS 2.0 SP8 : ntp (EulerOS-SA-2020-1817)

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet...

UBUNTU-CVE-2020-15852

An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tssinvalidateiobitmap mishandling causes a loss of synchronization between the I/O bitmaps ...

CVE-2020-15852

An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tssinvalidateiobitmap mishandling causes a loss of synchronization between the I/O bitmaps ...

Amazon Linux 2 : ntp (ALAS-2020-1455)

The version of ntp installed on the remote host is prior to 4.2.6p5-29. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1455 advisory. ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service daemon exit or...

Fedora: Security Advisory for nspr (FEDORA-2020-3ef1937475)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 32 Update: nspr-4.26.0-1.fc32

NSPR provides platform independence for non-GUI operating system facilities. These facilities include threads, thread synchronization, normal file and network I/O, interval timing and calendar time, basic memory management malloc and free and shared library linking...

Security update for ntp (moderate)

openSUSE Security Update: Security update for ntp Announcement ID: openSUSE-SU-2020:1007-1 Rating: moderate References: 1125401 1169740 1171355 1172651 1173334 992038 Cross-References: CVE-2018-8956 CVE-2020-11868 CVE-2020-13817 CVE-2020-15025 Affected Products: openSUSE Leap 15.2 An update that...

The vulnerability of the xfs_agf_verify function in the XFS file system of Linux operating systems allows a attacker to cause a service failure.

The vulnerability of the xfsagfverify function in the XFS file system of Linux operating systems is related to incorrect input validation. Exploiting this vulnerability can allow an attacker to cause a service failure by synchronizing a specially created file with the metadata of the mounted XFS...

The vulnerability of the VMware Tools utility set for Windows operating systems arises from synchronization errors when using shared resources, allowing a malicious individual to gain increased privileges.

The vulnerability of the VMware Tools utility set for Windows operating systems is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Medium: ntp

Issue Overview: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service daemon exit or system time change by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be ...

CVE-2020-7457

In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV62292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory...

CVE-2020-7457

In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV62292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory...

The vulnerability of the Ipc::Mem::PageStack::pop function in the Squid proxy server allows a hacker to cause a service failure.

The vulnerability of the Ipc::Mem::PageStack::pop function in the Squid proxy server is related to synchronization errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the `usb_mtp_write_data` function in the Qemu Media Transfer Protocol implementation, an emulator for hardware devices in the QEMU environment, allows a perpetrator to cause a service failure or execute arbitrary code.

The vulnerability of the usbmtpwritedata function in the Qemu Media Transfer Protocol implementation, within the QEMU hardware emulation software, arises due to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure or...

The vulnerability of the ntpd implementation of the Network Time Synchronization Protocol allows a attacker to cause a service failure.

The vulnerability of the ntpd implementation of the NTP synchronization protocol is related to a memory release error. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability of Cisco AMP, a security tool for protecting against malicious software, and Clam Antivirus, an antivirus protection tool, arises due to synchronization errors when using a common resource. This vulnerability allows a hacker to delete any files they desire.

The vulnerabilities of the Cisco AMP anti-virus protection tool and the Clam Antivirus antivirus tool are caused by synchronization errors when using a common resource. Exploiting these vulnerabilities can allow attackers to delete arbitrary files...

OPENSUSE-SU-2020:0934-1 Security update for ntp

This update for ntp fixes the following issues: ntp was updated to 4.2.8p15 - CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address frequently send to the client ntpd could have caused denial of service bsc1169740. - CVE-2018-8956: Fixed an issue which could have...