6828 matches found
Ubuntu: Security Advisory (USN-4424-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : snapd vulnerabilities (USN-4424-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4424-1 advisory. It was discovered that cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices ran on every boot without...
USN-4424-1: snapd vulnerabilities
It was discovered that cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices ran on every boot without restrictions. A physical attacker could exploit this to craft cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intende...
USN-4424-1 snapd vulnerabilities
It was discovered that cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices ran on every boot without restrictions. A physical attacker could exploit this to craft cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intende...
CVE-2020-11933
cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security...
PT-2020-12931
Name of the Vulnerable Software and Affected Versions snapd versions prior to 2.45.2 Ubuntu Core versions prior to 2.45.2 Description A physical attacker could exploit this issue by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device, bypassing...
DEBIAN-CVE-2020-11061
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched...
Huawei EulerOS: Security Advisory for cloud-init (EulerOS-SA-2020-1751)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
OSV-2020-728 Stack-buffer-overflow in ot::Ip6::OptionPadN::Init
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14854 Crash type: Stack-buffer-overflow WRITE 9 Crash state: ot::Ip6::OptionPadN::Init ot::Ip6::Ip6::RemoveMplOption ot::Ip6::Ip6::ProcessReceiveCallback...
OSV-2020-336 Stack-buffer-overflow in ot::NetworkData::PrefixTlv::Init
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12589 Crash type: Stack-buffer-overflow READ Crash state: ot::NetworkData::PrefixTlv::Init ot::NetworkData::Local::AddOnMeshPrefix otError ot::Ncp::NcpBase::HandlePropertyInsert...
PT-2020-22441
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type identified as Global-buffer-overflow READ 8. The crash state involves several functions: ne find element, ne parse, an...
PT-2020-22503
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow crash. Technical details about the crash include the crash type being a Stack-buffer-overflow WRITE 9. The...
PT-2020-22256
Name of the Vulnerable Software and Affected Versions OpenThread versions affected versions not specified Description A stack buffer overflow issue has been identified. The crash occurs in the ot::NetworkData::PrefixTlv::Init and ot::NetworkData::Local::AddOnMeshPrefix functions, and is related t...
PT-2020-22500
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow write crash. The crash state includes functions such as r buf read, parse function starts, and init items. N...
PT-2020-22407
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by a negative-size-param, as reported by OSS-Fuzz. The crash occurs in the following functions: r buf read, bin pe g...
Vulnerability of the go7007_snd_init() function (drivers/media/usb/go7007/snd-go7007.c) in the Linux kernel, allowing a hacker to cause a service failure
The vulnerability of the go7007sndinit function drivers/media/usb/go7007/snd-go7007.c in the Linux kernel is related to the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an attacker to cause service failures...
GLSA-202006-20 : Asterisk: Root privilege escalation
The remote host is affected by the vulnerability described in GLSA-202006-20 Asterisk: Root privilege escalation It was discovered that Gentoos Asterisk ebuild does not properly set permissions on its data directories. This only affects OpenRC systems, as the flaw was exploitable via the init...
Asterisk: Root privilege escalation
Background A Modular Open Source PBX System. Description It was discovered that Gentoo’s Asterisk ebuild does not properly set permissions on its data directories. This only affects OpenRC systems, as the flaw was exploitable via the init script. Impact A local attacker could escalate privileges...
Security Bulletin: Vulnerability in MongoDB affects IBM Spectrum Protect Plus (CVE-2019-2389)
Summary A denial of service vulnerability in MongoDB affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-2389 DESCRIPTION: MongoDB Server is vulnerable to a denial of service, caused by a flaw in the SysV init scripts. By inserting a specially-crafted PID file, a remote...
PT-2020-11546
Name of the Vulnerable Software and Affected Versions Android versions Android-10 Description The issue is related to a possible out of bounds write in the hal fd init function of hal fd.cc due to an incorrect bounds check. This could lead to local escalation of privilege, requiring System...