PT-2020-12931

Name of the Vulnerable Software and Affected Versions snapd versions prior to 2.45.2 Ubuntu Core versions prior to 2.45.2 Description A physical attacker could exploit this issue by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device, bypassing...

DEBIAN-CVE-2020-11061

In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched...

Huawei EulerOS: Security Advisory for cloud-init (EulerOS-SA-2020-1751)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OSV-2020-728 Stack-buffer-overflow in ot::Ip6::OptionPadN::Init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14854 Crash type: Stack-buffer-overflow WRITE 9 Crash state: ot::Ip6::OptionPadN::Init ot::Ip6::Ip6::RemoveMplOption ot::Ip6::Ip6::ProcessReceiveCallback...

OSV-2020-336 Stack-buffer-overflow in ot::NetworkData::PrefixTlv::Init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12589 Crash type: Stack-buffer-overflow READ Crash state: ot::NetworkData::PrefixTlv::Init ot::NetworkData::Local::AddOnMeshPrefix otError ot::Ncp::NcpBase::HandlePropertyInsert...

PT-2020-22503

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow crash. Technical details about the crash include the crash type being a Stack-buffer-overflow WRITE 9. The...

PT-2020-22256

Name of the Vulnerable Software and Affected Versions OpenThread versions affected versions not specified Description A stack buffer overflow issue has been identified. The crash occurs in the ot::NetworkData::PrefixTlv::Init and ot::NetworkData::Local::AddOnMeshPrefix functions, and is related t...

PT-2020-22500

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow write crash. The crash state includes functions such as r buf read, parse function starts, and init items. N...

PT-2020-22441

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type identified as Global-buffer-overflow READ 8. The crash state involves several functions: ne find element, ne parse, an...

PT-2020-22407

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by a negative-size-param, as reported by OSS-Fuzz. The crash occurs in the following functions: r buf read, bin pe g...

Vulnerability of the go7007_snd_init() function (drivers/media/usb/go7007/snd-go7007.c) in the Linux kernel, allowing a hacker to cause a service failure

The vulnerability of the go7007sndinit function drivers/media/usb/go7007/snd-go7007.c in the Linux kernel is related to the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an attacker to cause service failures...

GLSA-202006-20 : Asterisk: Root privilege escalation

The remote host is affected by the vulnerability described in GLSA-202006-20 Asterisk: Root privilege escalation It was discovered that Gentoos Asterisk ebuild does not properly set permissions on its data directories. This only affects OpenRC systems, as the flaw was exploitable via the init...

Asterisk: Root privilege escalation

Background A Modular Open Source PBX System. Description It was discovered that Gentoo’s Asterisk ebuild does not properly set permissions on its data directories. This only affects OpenRC systems, as the flaw was exploitable via the init script. Impact A local attacker could escalate privileges...

Security Bulletin: Vulnerability in MongoDB affects IBM Spectrum Protect Plus (CVE-2019-2389)

Summary A denial of service vulnerability in MongoDB affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-2389 DESCRIPTION: MongoDB Server is vulnerable to a denial of service, caused by a flaw in the SysV init scripts. By inserting a specially-crafted PID file, a remote...

PT-2020-11546

Name of the Vulnerable Software and Affected Versions Android versions Android-10 Description The issue is related to a possible out of bounds write in the hal fd init function of hal fd.cc due to an incorrect bounds check. This could lead to local escalation of privilege, requiring System...

CVE-2020-3230 Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerability

A vulnerability in the Internet Key Exchange Version 2 IKEv2 implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent IKEv2 from establishing new security associations. The vulnerability is due to incorrect handling of crafted IKEv2...

Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerability

A vulnerability in the Internet Key Exchange Version 2 IKEv2 implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent IKEv2 from establishing new security associations. The vulnerability is due to incorrect handling of crafted IKEv2...

PT-2020-2793

Name of the Vulnerable Software and Affected Versions Cisco IOS Software and Cisco IOS XE Software affected versions not specified Description A vulnerability in the Internet Key Exchange Version 2 IKEv2 implementation could allow an unauthenticated, remote attacker to prevent IKEv2 from...

CVE-2020-3230: Improper Input Validation

A vulnerability in the Internet Key Exchange Version 2 IKEv2 implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent IKEv2 from establishing new security associations. The vulnerability is due to incorrect handling of crafted IKEv2...

openSUSE Security Update : autoyast2 (openSUSE-2020-676)

This update for autoyast2 to version 4.1.15 fixes the following issues : Security issue fixed : - CVE-2019-18905: Removed all '--gpg-auto-import-keys' options from zypper commands bsc1140711. Non-security issue fixed : - Fix desktop files updating some icons and groups bsc1168123. - Restored some...