Unbreakable Enterprise kernel security update

4.1.12-124.43.4 - kvm: fix kvmioctlcreatedevice reference counting CVE-2019-6974 Jann Horn Orabug: 29434845 CVE-2019-6974 - KVM: nVMX: unconditionally cancel preemption timer in freenested CVE-2019-7221 Peter Shier Orabug: 29434898 CVE-2019-7221 - KVM: x86: work around leak of uninitialized stack...

chromium -- multiple vulnerabilities

Chrome releases reports: This release contains 35 security fixes, including: 1127322 Critical CVE-2020-15967: Use after free in payments. Reported by Man Yue Mo of GitHub Security Lab on 2020-09-11 1126424 High CVE-2020-15968: Use after free in Blink. Reported by Anonymous on 2020-09-09 1124659...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2020:1586-1 Rating: important References: 1055186 1058115 1065600 1065729 1094244 1136666 1152148 1152472 1152489 1153274 1154353 1155518 1155798 1156395 1167527 1170232 1170774 1171000 1171068 1171073...

Heap-based Buffer Overflow

Simple DirectMedia Layer SDL is vulnerable to heap-based buffer over-read. It is possible due to a flaw in InitIMAADPCM in audio/SDLwave.c...

Buffer Over-read

Simple DirectMedia Layer SDL is vulnerable to buffer over-read. It is possible due to a flaw in function SDLLoadWAVRW in audio/SDLwave.c...

Heap Buffer Over-read

Simple DirectMedia Layer SDL is vulnerable to Heap Buffer Over-read. It is possible due to a flaw in InitMSADPCM in audio/SDLwave.c...

Buffer Over-read

Simple DirectMedia Layer SDL is heap-based buffer over-read. It is possible due to a flaw in IMAADPCMnibble in audio/SDLwave.c...

October 1, 2020—KB4577063 (OS Build 19041.546) Preview

None None...

kernel: use-after-free in sound/core/timer.c

A memory flaw was found in the ALSA subsystem of the Linux kernel. The struct sndtimerinstance function fails the timer-maxinstances check leading to an invalid address. This could lead to a use-after-free vulnerability...

SDL: buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c

SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDLLoadWAVRW in audio/SDLwave.c...

SDL: heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c

SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMAADPCM in audio/SDLwave.c...

SDL: heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c

SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MSADPCMdecode in audio/SDLwave.c...

SDL: heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c

SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMAADPCMdecode in audio/SDLwave.c...

audiofile: NULL pointer dereference in ModuleState::setup() in modules/ModuleState.cpp allows for denial of service via crafted file

The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert...

Mac, Linux Users Now Targeted by FinSpy Variants

The FinSpy commercial spyware is back in recently observed campaigns against organizations and activists in Egypt. While the spyware previously targeted Windows, iOS and Android users, researchers have discovered these campaigns using new variants that target macOS and Linux users. FinSpy is a...

Information Leakage Vulnerabilities in the Unified Audio/Video Platform of Beijing Huayu Information Technology Co.

Ltd. is a company that specializes in software and information services. An information leakage vulnerability exists in the unified audio and video platform of Beijing Huayu Information Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information...

USN-4526-1 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities

It was discovered that the AMD Cryptographic Coprocessor device driver in the Linux kernel did not properly deallocate memory in some situations. A local attacker could use this to cause a denial of service memory exhaustion. CVE-2019-18808 It was discovered that the Conexant 23885 TV card device...

Google Android elevation of privilege vulnerability (CNVD-2020-53775)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. A security vulnerability exists in Android version 11. The vulnerability stems from the Audio HAL and can be exploited by an attacker to elevate local privileges...

heathcoteaudio.co.uk Cross Site Scripting vulnerability OBB-1355793

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Google Android Information Disclosure Vulnerability (CNVD-2020-54307)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. An information disclosure vulnerability exists in Android version 11, which stems from a possible residual data leak of audio metadata from Bluetooth AVRCP. An attacker could exploit the...