Advisory ROSA-SA-2021-1837

Software: fuse 2.9.2 OS: Cobalt 7.9 CVE-ID: CVE-2015-3202 CVE-Crit: HIGH CVE-DESC: fusermount in FUSE before 2.9.3-15 incorrectly clears the environment before calling 1 mount or 2 umount as root user, which allows local users to write arbitrary files via a created environment variable...

Advisory ROSA-SA-2021-1836

Software: freeradius 3.0.13 OS: Cobalt 7.9 CVE-ID: CVE-2019-11234 CVE-Crit: CRITICAL CVE-DESC: FreeRADIUS before 3.0.19 does not prevent the use of reflection for authentication spoofing, also known as the "Dragonblood" issue, similar to CVE-2019-9497. CVE-STATUS: default CVE-REV: Default CVE-ID:...

Advisory ROSA-SA-2021-1835

Software: firefox 78.5.0 OS: Cobalt 7.9 CVE-ID: CVE-2020-12400 CVE-Crit: MEDIUM CVE-DESC: When converting coordinates from projective to affine, modular inversion was not performed in constant time, leading to a possible time-based side-channel attack. This vulnerability affects Firefox 80 and...

Advisory ROSA-SA-2021-1833

Software: file 5.11 OS: Cobalt 7.9 CVE-ID: CVE-2014-9620 CVE-Crit: HIGH CVE-DESC: ELF parser in files 5.08 through 5.21 allows remote attackers to cause a denial of service with a large number of notes. CVE-STATUS: Default CVE-REV: Default CVE-ID: CVE-2018-1183 CVE-Crit: CRITICAL CVE-DESC: In Del...

Advisory ROSA-SA-2021-1832

Software: exempi 2.2.0 OS: Cobalt 7.9 CVE-ID: CVE-2017-18235 CVE-Crit: MEDIUM CVE-DESC: An issue was discovered in Exempi before 2.4.3. The VPXChunk class in XMPFiles / source / FormatSupport / WEBPSupport.cpp does not guarantee non-zero width and height values, allowing remote attackers to cause...

Advisory ROSA-SA-2021-1831

Software: evolution-data-server 3.28.5 OS: Cobalt 7.9 CVE-ID: CVE-2020-14928 CVE-Crit: MEDIUM CVE-DESC: From evolution-data-server eds to 3.36.3 there is an issue with STARTTLS buffering that affects SMTP and POP3. When the server sends a "start TLS" response, eds reads additional data and...

Advisory ROSA-SA-2021-1830

Software: evolution 3.28.5 OS: Cobalt 7.9 CVE-ID: CVE-2020-11879 CVE-Crit: MEDIUM CVE-DESC: A problem was found in GNOME Evolution before 3.35.91. Using the proprietary not RFC6068 parameter mailto? Attach = ..., a website or other mailto link source could cause Evolution to attach local files or...

Advisory ROSA-SA-2021-1829

Software: erlang R16B OS: Cobalt 7.9 CVE-ID: CVE-2011-0766 CVE-Crit: MEDIUM CVE-DESC: The random number generator in the Crypto application before 2.0.2.2.2 and SSH before 2.0.5, which was used in the Erlang / OTP ssh library before R14B03, uses predictable starting numbers based on the current...

Advisory ROSA-SA-2021-1827

Software: elinks 0.12 OS: Cobalt 7.9 CVE-ID: CVE-2012-6709 CVE-Crit: MEDIUM CVE-DESC: ELinks 0.12 and Twibright Links 2.3 lack SSL certificate validation. CVE-STATUS: Default CVE-REV: Default...

Advisory ROSA-SA-2021-1826

Software: ed 1.9 OS: Cobalt 7.9 CVE-ID: CVE-2015-2987 CVE-Crit: MEDIUM CVE-DESC: Type74 ED before 4.0 incorrectly uses 128-bit ECB encryption for small files, making it easier for attackers to obtain plaintext data by differential cryptanalysis of a file with an original length of less than 128...

Advisory ROSA-SA-2021-1824

Software: dovecot 2.2.36 OS: Cobalt 7.9 CVE-ID: CVE-2019-10691 CVE-Crit: HIGH CVE-DESC: The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly cause the authentication service to fail by attempting to authenticate with an invalid UTF-8 sequence as the username. CVE-STATUS:...

Advisory ROSA-SA-2021-1823

Software: dnsmasq 2.76 OS: Cobalt 7.9 CVE-ID: CVE-2017-13704 CVE-Crit: HIGH CVE-DESC: In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in the memset call gets a negative value. Since this is an unsigned value, memset writes up to...

Advisory ROSA-SA-2021-1822

Software: dhcp 4.2.5 OS: Cobalt 7.9 CVE-ID: CVE-2013-2494 CVE-Crit: HIGH CVE-DESC: libdns in ISC DHCP 4.2.x through 4.2.5-P1 allows remote name servers to cause a denial of service memory consumption using vectors that include a regular expression, as demonstrated by a memory scarcity attack on a...

Advisory ROSA-SA-2021-1821

Software: dcraw 9.19 OS: Cobalt 7.9 CVE-ID: CVE-2018-19565 CVE-Crit: HIGH CVE-DESC: Buffer re-reading in cropmaskedpixels in dcraw before 9.28 could have been used by attackers who could provide malicious files to crash the application that binds the dcraw code or leak private information...

Advisory ROSA-SA-2021-1819

Software: cvs 1.11.23 OS: Cobalt 7.9 CVE-ID: CVE-2020-2324 CVE-Crit: HIGH CVE-DESC: The Jenkins CVS 2.16 and earlier plug-in does not configure its XML syntactic parser to prevent attacks on XML external objects XXE. CVE-STATUS: default CVE-REV: default...

Advisory ROSA-SA-2021-1817

Software: cups-filters 1.0.35 OS: Cobalt 7.9 CVE-ID: CVE-2013-6473 CVE-Crit: MEDIUM CVE-DESC: Multiple heap-based buffer overflows in the urftopdf filter in cups-filters 1.0.25 through 1.0.47 allow remote attackers to execute arbitrary code across a large 1 page or 2 lines in a URF file...

Advisory ROSA-SA-2021-1816

Software: cups 1.6.3 OS: Cobalt 7.9 CVE-ID: CVE-2013-6891 CVE-Crit: HIGH CVE-DESC: lppasswd in CUPS before 1.7.1 when run with setuid privileges allows local users to read parts of arbitrary files via modified HOME environment variable and symbolic link attack using .cups / client.conf. CVE-STATU...

Advisory ROSA-SA-2021-1814

Software: coreutils 8.22 OS: Cobalt 7.9 CVE-ID: CVE-2017-18018 CVE-Crit: MEDIUM CVE-DESC: In GNU Coreutils before 8.29, chown-core.c in chown and chgrp does not prevent replacing a simple file with a symbolic link while using POSIX "-R -L" parameters, allowing local users to change ownership of...

Advisory ROSA-SA-2021-1813

Software: clamav 0.102.4 OS: Cobalt 7.9 CVE-ID: CVE-2021-1386 CVE-Crit: HIGH CVE-DESC: A vulnerability in the Dynamic Link Library DLL loading mechanism in Cisco Advanced Malware Protection AMP for Windows Connector endpoints, ClamAV for Windows, and Immunet could allow an authenticated local...

Advisory ROSA-SA-2021-1812

Software: cifs-utils 6.2 OS: Cobalt 7.9 CVE-ID: CVE-2014-2830 CVE-Crit: MEDIUM CVE-DESC: stack-based buffer overflow in cifskey.c or cifscreds.c in cifs-utils before 6.4, used in pamcifscreds, allows remote attackers to have undefined impact via unknown vectors. CVE-STATUS: default CVE-REV: defau...