PT-2020-17681

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions in Agatti, Kamorta, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SXR1130 Description A buffer overflow could occur due to improper use of the API, as the UIE init does not contain a buffer size parameter. This...

libsndfile:sndfile_fuzzer: Use-of-uninitialized-value in alac_decoder_init

Detailed Report: https://oss-fuzz.com/testcase?key=5729600380076032 Project: libsndfile Fuzzing Engine: libFuzzer Fuzz Target: sndfilefuzzer Job Type: libfuzzermsanlibsndfile Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: alacdecoderinit alacreaderinit...

USN-3081-2 tomcat6 vulnerability

Dawid Golunski discovered that the Tomcat init script incorrectly handled creating log files. A remote attacker could possibly use this issue to obtain root privileges...

USN-3081-2: Tomcat vulnerability

Dawid Golunski discovered that the Tomcat init script incorrectly handled creating log files. A remote attacker could possibly use this issue to obtain root privileges...

Scientific Linux Security Update : cloud-init on SL7.x x86_64 (20201001)

Security Fixes : - cloud-init: Use of random.choice when generating random password CVE-2020-8631 - cloud-init: Too short random password length in ccsetpassword in config/ccsetpasswords.py CVE-2020-8632 - cloud-init: default configuration disabled deletion of SSH host keys CVE-2018-10896 C Tenab...

cloud security update

CentOS Errata and Security Advisory CESA-2020:3898 An update for cloud-init is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

CentOS 7 : cloud-init (RHSA-2020:3898)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3898 advisory. - The default cloud-init configuration, in cloud-init 0.6.2 and newer, included sshdeletekeys: 0, disabling cloud-init's deletion of ssh host keys. In...

USN-4591-1 linux, linux-hwe, linux-hwe-5.4, linux-oem, linux-raspi, linux-raspi-5.4, linux-snapdragon vulnerabilities

Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-confusion error. A physically proximate remote attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2020-12351 Andy Nguyen discovered that the...

ALPINE-CVE-2020-6106

An exploitable information disclosure vulnerability exists in the initnodemanager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A specially crafted filesystem can be used to disclose information. An attacker can provide a malicious file to trigger this vulnerability...

DEBIAN-CVE-2020-6106

An exploitable information disclosure vulnerability exists in the initnodemanager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A specially crafted filesystem can be used to disclose information. An attacker can provide a malicious file to trigger this vulnerability...

UBUNTU-CVE-2020-6106

An exploitable information disclosure vulnerability exists in the initnodemanager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A specially crafted filesystem can be used to disclose information. An attacker can provide a malicious file to trigger this vulnerability...

PT-2020-22058

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap buffer overflow error. Technical details about the crash include the crash type being a heap-buffer-overflow WRITE 1. The...

AZL-6773 CVE-2020-26571 affecting package opensc for versions less than 0.22.0-1

The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in scpkcs15emugemsafeGPKinit...

UBUNTU-CVE-2020-26571

The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in scpkcs15emugemsafeGPKinit...

Information Disclosure

cloud-init is vulnerable to information disclosure. The vulnerability exists as ccsetpassword in config/ccsetpasswords.py accepts a password with weak length...

Predictable Password

The cloud-init is using predictable password. It uses andom.choice when generating random password...

kernel: Memory leak in sit_init_net() in net/ipv6/sit.c

A flaw was found in the way the sitinitnet function in the Linux kernel handled resource cleanup on errors. This flaw allows an attacker to use the error conditions to crash the system...

cloud-init: Too short random password length in cc_set_password in config/cc_set_passwords.py

A flaw was found in cloud-init, where it uses short passwords when generating a random password in new instances. Depending on the instance configuration, a remote or local attacker may abuse this vulnerability to guess the password of the victim user...

cloud-init: Use of random.choice when generating random password

A flaw was found in cloud-init, where it uses the random.choice function when creating sensitive random strings used for generating a random password in new instances. Depending on the instance configuration, a remote or local attacker may abuse this vulnerability to guess the password of the...

cloud-init: default configuration disabled deletion of SSH host keys

The default cloud-init configuration included "sshdeletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct...