Debian DLA-2385-1 : linux-4.19 security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, or information leak. CVE-2019-3874 Kernel buffers allocated by the SCTP network protocol were not limited by the memory cgroup controller. A local user could potentially us...

Security Bulletin: IBM Cloud Private is vulnerable to a MongoDB vulnerability (CVE-2020-7921)

Summary IBM Cloud Private is vulnerable to a MongoDB vulnerability Vulnerability Details CVEID: CVE-2020-7921 DESCRIPTION: MongoDB Server could allow a remote authenticated attacker to bypass security restrictions, caused by improper serialization of internal state in the authorization subsystem...

An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors as demonstrated by a NULL pointer dereference aka CID-485b06aadb93.

...

CVE-2020-14351

A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integri...

UBUNTU-CVE-2020-14351

A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integri...

Cisco IOS and IOS XE Denial of Service Vulnerability (CNVD-2021-43444)

Cisco IOS and IOS XE are both operating systems developed by Cisco in the United States for its network devices. A denial of service vulnerability exists in the ISDN subsystem of Cisco IOS and IOS XE, which can be exploited by an attacker to cause a process crash by sending a malicious ISDN Q.931...

CVE-2020-3511

A vulnerability in the ISDN subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service DoS condition. The vulnerability is due to insufficient input validation when the ISDN...

CVE-2020-3393

A vulnerability in the application-hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an affected device. The attacker could execute IOS XE commands outside the application-hosting subsystem Docker container as well as on the...

Input validation

A vulnerability in the ISDN subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service DoS condition. The vulnerability is due to insufficient input validation when the ISDN...

CVE-2020-3511

CVE-2020-3511 affects Cisco IOS and IOS XE ISDN Q.931 handling. The issue stems from insufficient input validation in the ISDN Q.931 message processing, which could allow an unauthenticated, adjacent attacker to cause a crash and reload, resulting in DoS. Vulnerable software includes Cisco IOS an...

Cisco IOS and IOS XE Software ISDN Q.931 Denial of Service Vulnerability

A vulnerability in the ISDN subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service DoS condition. The vulnerability is due to insufficient input validation when the ISDN...

PT-2020-4424 · Cisco +1 · Cisco Ios Xe +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in the application-hosting subsystem could allow an authenticated, local attacker to elevate privileges to root on an affected device. The attacker could execu...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4526-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4526-1 advisory. It was discovered that the AMD Cryptographic Coprocessor device driver in the Linux kernel did not properly deallocate memory in some...

Privilege Escalation

linux is vulnerable to privilege escalation. The vulnerability exists through a null pointer dereference in the Linux kernel cgroupv2 subsystem...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5845)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5845 advisory. - sched/fair: Fix low cpu usage with high throttling by removing expiration of cpu-local slices Dave Chiluk Orabug: 31350999 CVE-2019-19922 - sched/fai...

Buffer overflow

Improper buffer restrictions in network subsystem in provisioned IntelR AMT and IntelR ISM versions before 11.8.79, 11.12.79, 11.22.79, 12.0.68 and 14.0.39 may allow an unauthenticated user to potentially enable escalation of privilege via network access. On un-provisioned systems, an authenticat...

CVE-2020-8758

CVE-2020-8758 affects Intel AMT/ISM: improper buffer restrictions in the network subsystem may allow escalation of privilege. In provisioned systems, an unauthenticated attacker on the network can potentially escalate privileges; on un-provisioned systems, an authenticated user may escalate via l...

Critical Intel Active Management Technology Flaw Allows Privilege Escalation

Intel patched a critical privilege escalation vulnerability in its Active Management Technology AMT, which is used for remote out-of-band management of PCs. AMT is part of the Intel vPro platform Intel’s umbrella marketing term for its collection of computer hardware technologies and is primarily...

Amazon Linux AMI : kernel (ALAS-2020-1430)

The version of kernel installed on the remote host is prior to 4.14.193-113.317. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1430 advisory. 2024-05-23: CVE-2020-14356 was added to this advisory. A flaw null pointer dereference in the Linux kernel cgroupv2...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4485-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4485-1 advisory. Timothy Michaud discovered that the i915 graphics driver in the Linux kernel did not properly validate user memory locations for the...