FreeBSD : adns -- multiple vulnerabilities (08de38d2-e2d0-11ea-9538-0c9d925bbbc0)

Ian Jackson and the adns project reports : Vulnerable applications: all adns callers. Exploitable by: the local recursive resolver. Likely worst case: Remote code execution. Vulnerable applications: those that make SOA queries. Exploitable by: upstream DNS data sources. Likely worst case: DoS cra...

FreeBSD : curl -- expired pointer dereference vulnerability (b905dff4-e227-11ea-b0ea-08002728f74c)

curl security problems : CVE-2020-8231: wrong connect-only connection An application that performs multiple requests with libcurl's multi API and sets the CURLOPTCONNECTONLY option, might in rare circumstances experience that when subsequently using the setup connect-only transfer, libcurl will...

FreeBSD : Icinga Web 2 -- directory traversal vulnerability (f60561e7-e23e-11ea-be64-507b9d01076a)

Icinga development team reports : CVE-2020-24368 Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4,...

FreeBSD : security/trousers -- several vulnerabilities (e37a0a7b-e1a7-11ea-9538-0c9d925bbbc0)

the TrouSerS project reports reports : If the tcsd daemon is started with root privileges, it fails to drop the root gid after it is no longer needed. If the tcsd daemon is started with root privileges, the tss user has read and write access to the /etc/tcsd.conf file. If the tcsd daemon is start...

FreeBSD : chromium -- heap buffer overflow (64575bb6-e188-11ea-beed-e09467587c17)

Chrome Releases reports : This release contains one security fix : - 1115345 High CVE-2020-6556: Heap buffer overflow in SwiftShader. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2020-08-12 C Tenable Network Security, Inc. The descriptive text and package checks in this...

FreeBSD : ceph14 -- HTTP header injection via CORS ExposeHeader tag (f20eb9a4-dfea-11ea-a9b8-9c5c8e84d621)

Red Hat bugzilla reports : A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection...

FreeBSD : snmptt -- malicious shell code (b8ea5b66-deff-11ea-adef-641c67a117d8)

Snmptt reports : Fixed a security issue with EXEC / PREXEC / unknowntrapexec that could allow malicious shell code to be executed. Fixed a bug with EXEC / PREXEC / unknowntrapexec that caused commands to be run as root instead of the user defined in daemonuid. C Tenable Network Security, Inc. The...

FreeBSD : security/py-ecdsa -- multiple issues (a23ebf36-e8b6-4665-b0f3-4c977f9a145c)

py-ecdsa developers report : Fix CVE-2019-14853 - possible DoS caused by malformed signature decoding. Fix CVE-2019-14859 - signature malleability caused by insufficient checks of DER encoding C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

FreeBSD : net/rsync -- multiple zlib issues (085399ab-dfd7-11ea-96e4-80ee73bc7b66)

rsync developers reports : Various zlib fixes, including security fixes for CVE-2016-9843, CVE-2016-9842, CVE-2016-9841, and CVE-2016-9840 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020...

FreeBSD : jenkins -- Buffer corruption in bundled Jetty (09ea1b08-1d3e-4bf2-91a1-d6573f4da3d8)

Jenkins Security Advisory : DescriptionCritical SECURITY-1983 / CVE-2019-17638 Buffer corruption in bundled Jetty C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrine and...

Security update for hylafax+ (moderate)

openSUSE Security Update: Security update for hylafax+ Announcement ID: openSUSE-SU-2020:1210-1 Rating: moderate References: 1173519 1173521 Cross-References: CVE-2020-15396 CVE-2020-15397 Affected Products: openSUSE Leap 15.1 An update that fixes two vulnerabilities is now available. Description...

FreeBSD : ilmbase, openexr -- v2.5.3 is a patch release with various bug/security fixes (b1d6b383-dd51-11ea-a688-7b12871ef3ad)

Cary Phillips reports : v2.5.3 - Patch release with various bug/security fixes ... : - Various sanitizer/fuzz-identified issues related to handling of invalid input C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML databa...

FreeBSD : mail/dovecot -- multiple vulnerabilities (87a07de1-e55e-4d51-bb64-8d117829a26a)

Aki Tuomi reports : Parsing mails with a large number of MIME parts could have resulted in excessive CPU usage or a crash due to running out of stack memory.. Dovecot's NTLM implementation does not correctly check message buffer size, which leads to reading past allocation which can lead to crash...

FreeBSD : jenkins -- multiple vulnerabilities (eef0d2d9-78c0-441e-8b03-454c5baebe20)

Jenkins Security Advisory : DescriptionHigh SECURITY-1955 / CVE-2020-2229 Stored XSS vulnerability in help icons High SECURITY-1957 / CVE-2020-2230 Stored XSS vulnerability in project naming strategy High SECURITY-1960 / CVE-2020-2231 Stored XSS vulnerability in 'Trigger builds remotely' C Tenabl...

FreeBSD : chromium -- multiple vulnerabilities (1110e286-dc08-11ea-beed-e09467587c17)

Chrome Releases reports : This release contains 15 security fixes, including : - 1107433 High CVE-2020-6542: Use after free in ANGLE. Reported by Piotr Bania of Cisco Talos on 2020-07-20 - 1104046 High CVE-2020-6543: Use after free in task scheduling. Reported by Looben Yang on 2020-07-10 - 11084...

FreeBSD : bftpd -- Multiple vulnerabilities (6b6de127-db0b-11ea-ba1e-1c39475b9f84)

Bftpd project reports : Bftpd is vulnerable to out of bounds memory access, file descriptor leak and a potential buffer overflow. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques...

FreeBSD : puppetdb -- Multiple vulnerabilities (10e3ed8a-db7f-11ea-8bdf-643150d3111d)

Puppetlabs reports : In June 2020, jackson-databind published security updates addressing several CVEs. Previous releases of PuppetDB contain a vulnerable version of jackson.core:jackson-databind. PuppetDB 5.2.18 contains an updated version of jackson-databind that has patched the vulnerabilities...

FreeBSD : trafficserver -- resource consumption (6fd773d3-bc5a-11ea-b38d-f0def1d0c3ea)

Bryan Call reports : ATS is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML databa...

FreeBSD Input Validation Error Vulnerability (CNVD-2020-49578)

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A security vulnerability exists in FreeBSD that stems from a program that does not perform length checking. An attacker could exploit the vulnerability to execute code...

FreeBSD : Apache httpd -- Multiple vulnerabilities (76700d2f-d959-11ea-b53c-d4c9ef517024)

The Apache httpd projec reports : - modhttp2: Important: Push Diary Crash on Specifically Crafted HTTP/2 Header CVE-2020-9490 A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. -...