Fedora 31 : e2fsprogs (2020-a724cc7926)

Fixes ----- A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. Addresses CVE-2019-5094 E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled. E2fsck will not disable the low dtime...

Oracle VM VirtualBox Denial of Service Vulnerability (CNVD-2020-04049)

Oracle VM VirtualBox is a cross-platform virtualization software for x86 systems. A denial of service vulnerability exists in the Core component of Oracle VM VirtualBox versions prior to 5.2.36, 6.0.16, and 6.1.2. An attacker could exploit this vulnerability to cause a denial of service hangs or...

dovecot -- multiple vulnerabilities

Aki Tuomi reports: lib-smtp doesn't handle truncated command parameters properly, resulting in infinite loop taking 100% CPU for the process. This happens for LMTP where it doesn't matter so much and also for submission-login where unauthenticated users can trigger it. Aki also reports: Snippet...

Haxx Libcurl NTLM Buffer Overflow (CVE-2019-3822)

A buffer overflow vulnerability exists in Haxx Libcurl. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

Out-of-bounds

An issue was discovered in Bftpd 5.3. Under certain circumstances, an out-of-bounds read is triggered due to an uninitialized value. The daemon crashes at startup in the hidegroupsinit function in dirlist.c...

CVE-2019-11760

A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox 70, Thunderbird 68.2, and Firefox ESR 68.2...

CVE-2018-3074

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Roles. Supported versions that are affected are 8.0.11 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...

NewStart CGSL CORE 5.05 / MAIN 5.05 : libarchive Multiple Vulnerabilities (NS-SA-2019-0248)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libarchive packages installed that are affected by multiple vulnerabilities: - libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards release v3.1.0 onwards contains a CWE-415: Double Free vulnerability ...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM i

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluat...

SUSE-SU-2019:3309-1 Security update for xen

This update for xen fixes the following issues: - CVE-2019-19581: Fixed a potential out of bounds on 32-bit Arm bsc1158003 XSA-307. - CVE-2019-19582: Fixed a potential infinite loop when x86 accesses to bitmaps with a compile time known size of 64 bsc1158003 XSA-307. - CVE-2019-19583: Fixed...

CVE-2019-18960

Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes...

CVE-2019-18960

Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes...

Design/Logic Flaw

Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes...

CVE-2019-18960

Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes...

Adobe Acrobat and Reader Heap Overflow (APSB19-55: CVE-2019-16451)

A buffer overflow vulnerability exists in Adobe Acrobat and Reader. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20191205)

Security Fixes : - Kernel: KVM: OOB memory access via mmio ring buffer CVE-2019-14821 - kernel: local attacker can trigger multiple use-after-free conditions results in privilege escalation CVE-2019-15239 Bug Fixes : - On SL 7.7 kernel SCSI VPD information for NVMe drives is missing breaks...

Mozilla Firefox ESR < 68.3

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-37 advisory. - Mozilla developers Christoph Diehl, Nathan Froyd, Jason Kratzer, Christian Holler, Karl Tomlinson, Tyson...

Mozilla Firefox < 71.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 71.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-36 advisory. - Mozilla developers and community members Philipp, Diego Calleja, Mikhail Gavrilov, Jason Kratzer, Christian...

Mozilla: Buffer overflow in plain text serializer

The plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 68.3, Firefox ESR 68.3, and Firefox 71...

Mozilla: Buffer overflow in plain text serializer

The plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 68.3, Firefox ESR 68.3, and Firefox 71...