UBUNTU-CVE-2020-24352

An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati2dblt routine in hw/display/ati2d.c while handling MMIO write operations through the atimmwrite callback. A malicious guest could use this flaw ...

kernel: NFS client crash due to index buffer overflow during Direct IO write causing kernel panic

A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to crash. In some cases, a reach out of the index after one memory allocation by kmalloc will cause a kernel panic. The highest threat from this vulnerability is to data confidentiality...

kernel: NFS client crash due to index buffer overflow during Direct IO write causing kernel panic

A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to crash. In some cases, a reach out of the index after one memory allocation by kmalloc will cause a kernel panic. The highest threat from this vulnerability is to data confidentiality...

Denial of Service Vulnerability in Allen-Bradley CompactLogic 1769-L33ER

Rockwell Automation, Inc. is one of the world's largest automation and information technology companies. A denial of service vulnerability exists in the Allen-Bradley CompactLogic 1769-L33ER, which can be exploited by an attacker to cause an I/O module to stop working and deny service...

PYSEC-2020-133

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b a...

PYSEC-2020-290

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b a...

PYSEC-2020-133

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b a...

GHSA-X9J7-X98R-R4W2 Segmentation fault in tensorflow-lite

Impact If a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. Patches We have patched the issue in d58c96946b and will release patch releases for all versions between 1.1...

[SECURITY] Fedora 33 Update: libxml2-2.9.10-7.fc33

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

CVE-2020-15480

An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. The kernel driver exposes IOCTL functionality that allows low-privilege users to read and write to arbitrary Model Specific Registers MSRs. This could lead to arbitrary Ring-0 code...

The vulnerability of the Direct IO function in Linux operating system kernels allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of the Direct IO function in Linux operating systems lies in the fact that operations are performed outside the buffer boundaries. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures...

The vulnerability of the ftusbbus2.sys component of the FabulaTech USB for Remote Desktop software allows a hacker to gain elevated privileges.

The vulnerability of the ftusbbus2.sys component of the FabulaTech USB for Remote Desktop software relates to privilege management errors. Exploiting this vulnerability allows an attacker to enhance their privileges by using a specially crafted system call, IoCtl...

CVE-2020-15518

VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests...

kernel: use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body

A flaw was found in the Linux kernel's implementation of the BFQ IO scheduler. This flaw allows a local user able to groom system memory to cause kernel memory corruption and possible privilege escalation by abusing a race condition in the IO scheduler...

kernel: use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body

A flaw was found in the Linux kernel's implementation of the BFQ IO scheduler. This flaw allows a local user able to groom system memory to cause kernel memory corruption and possible privilege escalation by abusing a race condition in the IO scheduler...

GHSA-QCXH-W3J9-58QR Apache Tomcat Denial of Service vulnerability

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servle...

kernel: use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body

A flaw was found in the Linux kernel's implementation of the BFQ IO scheduler. This flaw allows a local user able to groom system memory to cause kernel memory corruption and possible privilege escalation by abusing a race condition in the IO scheduler...

kernel: use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body

A flaw was found in the Linux kernel's implementation of the BFQ IO scheduler. This flaw allows a local user able to groom system memory to cause kernel memory corruption and possible privilege escalation by abusing a race condition in the IO scheduler...

The input/output controller BK9000 Ethernet TCP/IP Bus Coupler is vulnerable to uncontrolled resource consumption, allowing a intruder to cause a service failure.

The vulnerability of the BK9000 Ethernet TCP/IP Bus Coupler input/output controller is related to an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

bitcoind/Bitcoin-Qt 'CTransaction::FetchInputs' method denied service

Bitcoin is an e-currency generated using open source P2P software. A vulnerability in the 'CTransaction::FetchInputs' method in bitcoind and Bitcoin-Qt versions prior to 0.8.0rc1 stems from the program's failure to incrementally check the consumed predecessor signals, i.e., copying transactions...