SDL: heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c

SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMSADPCM in audio/SDLwave.c inside the wNumCoef loop...

kernel: Memory leak in sit_init_net() in net/ipv6/sit.c

A flaw was found in the way the sitinitnet function in the Linux kernel handled resource cleanup on errors. This flaw allows an attacker to use the error conditions to crash the system...

Huawei EulerOS: Security Advisory for cloud-init (EulerOS-SA-2020-2041)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization for ARM 64 3.0.6.0 : cloud-init (EulerOS-SA-2020-2041)

According to the version of the cloud-init package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The default cloud-init configuration, in cloud-init 0.6.2 and newer, included 'sshdeletekeys: 0', disabling cloud-init...

RHEL 7 : cloud-init (RHSA-2020:3898)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3898 advisory. The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization...

PT-2020-22002

Name of the Vulnerable Software and Affected Versions OpenSmartCard versions affected versions not specified Description The issue is related to a heap buffer overflow error. Technical details about the crash include the sc oberthur parse publicinfo function, sc pkcs15emu oberthur init function,...

Google gperftools 2.7 has a memory leak in malloc_extension.cc related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program

...

An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints aka CID-998912346c0d.

...

PT-2020-22868

Уязвимость загружаемого модуля drivers/net/ethernet/broadcom/bnx2.ko ядра операционной системы Linux связана с утечкой памяти в реализации обработчика bnx2 init one. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании, путем подключения устройства QLogic bnx2 network и...

How to manually collect recovery media logs for Veeam Agent for Linux

Challenge You cannot collect recovery media logs for Veeam Agent for Linux from the repository. In such a case, you can still manually collect recovery media logs from the Linux machine where the bare-metal restore is performed. Cause If the bare-metal restore is not completed, the recovery media...

cloud-init: default configuration disabled deletion of SSH host keys

The default cloud-init configuration included "sshdeletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct...

Low: Red Hat Security Advisory: cloud-init security update

An update for cloud-init is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

RHEL 8 : cloud-init (RHSA-2020:3644)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:3644 advisory. The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to...

@uni-cli/cli (>=1.0.6, <=1.0.12), @uni-cli/init (1.0.12) +1 more potentially affected by unknown CVE via fs-extar (0.0.1-security)

fs-extar NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on fs-extar and may be impacted: - @uni-cli/cli =1.0.6, =1.0.12 - @uni-cli/init 1.0.12 - hwsz-tools 1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-435C-QCPM-WJW5...

Huawei EulerOS: Security Advisory for cloud-init (EulerOS-SA-2020-1840)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : cloud-init (EulerOS-SA-2020-1840)

According to the version of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The default cloud-init configuration, in cloud-init 0.6.2 and newer, included 'sshdeletekeys: 0', disabling cloud-init's deletion of ssh host...

PT-2020-6547 · Unknown +1 · F2Fs-Tools +1

Name of the Vulnerable Software and Affected Versions: F2fs-Tools F2fs.Fsck versions 1.12 through 1.13 Description: An information disclosure issue exists in the init node manager functionality. A specially crafted filesystem can be used to disclose information. An attacker can provide a maliciou...

In cloud-init through 19.4 rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value which makes it easier for attackers to guess passwords.

...

cloud-init through 19.4 relies on Mersenne Twister for a random password which makes it easier for attackers to predict passwords because rand_str in cloudinit/util.py calls the random.choice function.

...

The default cloud-init configuration in cloud-init 0.6.2 and newer included "ssh_deletekeys: 0" disabling cloud-init's deletion of ssh host keys. In some environments this could lead to instances created by cloning a golden master or template system sharing ssh host keys and being able to impersonate one another or conduct man-in-the-middle attacks.

...