Exploiting Spectre Over the Internet

Google has demonstrated exploiting the Spectre CPU attack remotely over the web: Today, were sharing proof-of-concept PoC code that confirms the practicality of Spectre exploits against JavaScript engines. We use Google Chrome to demonstrate our attack, but these issues are not specific to Chrome...

VulnCheck KEV: CVE-2021-27562

Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure NS world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment NSPE handler mode. This vulnerability affects...

Fedora: Security Advisory for arm-none-eabi-newlib (FEDORA-2021-332fb9c796)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 33 : arm-none-eabi-newlib (2021-267c08cc40)

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-267c08cc40 advisory. - A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nanomemalign,...

Fedora 32 : arm-none-eabi-newlib (2021-332fb9c796)

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-332fb9c796 advisory. - A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nanomemalign,...

Fedora: Security Advisory for arm-none-eabi-newlib (FEDORA-2021-267c08cc40)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 33 Update: arm-none-eabi-newlib-4.1.0-1.fc33

Newlib is a C library intended for use on embedded systems. It is a conglomeration of several library parts, all under free software licenses that make them easily usable on embedded products...

EulerOS Virtualization for ARM 64 3.0.2.0 : unbound (EulerOS-SA-2021-1401)

According to the version of the unbound package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a...

EulerOS Virtualization for ARM 64 3.0.2.0 : cups (EulerOS-SA-2021-1379)

According to the version of the cups package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - In arrayfind of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local...

EulerOS Virtualization for ARM 64 3.0.2.0 : samba (EulerOS-SA-2021-1380)

According to the version of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC...

EulerOS Virtualization for ARM 64 3.0.2.0 : curl (EulerOS-SA-2021-1399)

According to the version of the curl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard...

EulerOS Virtualization for ARM 64 3.0.2.0 : hunspell (EulerOS-SA-2021-1400)

According to the version of the hunspell package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.CVE-2019-16707 Note th...

EulerOS Virtualization for ARM 64 3.0.2.0 : libproxy (EulerOS-SA-2021-1404)

According to the version of the libproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC fil...

EulerOS Virtualization for ARM 64 3.0.2.0 : libjpeg-turbo (EulerOS-SA-2021-1405)

According to the version of the libjpeg-turbo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - In generatejsimdyccrgbconvertneon of jsimdarm64neon.S, there is a possible out of bounds write due to a missing...

EulerOS Virtualization for ARM 64 3.0.2.0 : libtiff (EulerOS-SA-2021-1393)

According to the version of the libtiff package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tiflzw.c resulting in DoS or code execution via a...

EulerOS Virtualization for ARM 64 3.0.2.0 : mesa (EulerOS-SA-2021-1385)

According to the version of the mesa packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. ...

EulerOS Virtualization for ARM 64 3.0.2.0 : openssl (EulerOS-SA-2021-1376)

According to the version of the openssl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the...

EulerOS Virtualization for ARM 64 3.0.2.0 : openssh (EulerOS-SA-2021-1398)

According to the version of the openssh packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy leading to an information leak in the algorithm...

EulerOS Virtualization for ARM 64 3.0.2.0 : python-lxml (EulerOS-SA-2021-1402)

According to the version of the python-lxml package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browser...

EulerOS Virtualization for ARM 64 3.0.2.0 : OpenLDAP (EulerOS-SA-2021-1394)

According to the versions of the OpenLDAP packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - OpenLDAP An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate...