Debian dla-3516 : burp - security update

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3516 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3516-1 [email protected]...

CVE-2023-38494

MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for this issue...

[SECURITY] [DLA 3515-1] cjose security update

Debian LTS Advisory DLA-3515-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 04, 2023 https://wiki.debian.org/LTS Package : cjose Version : 0.6.1+dfsg1-1+deb10u1 CVE ID : CVE-2023-37464 Debian Bug : 1041423 An incorrect Authentication Tag length usage was...

USN-6275-1: Cargo vulnerability

Addison Crump discovered that Cargo incorrectly set file permissions on UNIX-like systems when extracting crate archives. If the crate would contain files writable by any user, a local attacker could possibly use this issue to execute code as another user...

USN-6273-1: poppler vulnerabilities

Jieyong Ma discovered that poppler incorrectly handled certain malformed PDF files. A remote attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. CVE-2022-27337 It was discovered that...

USN-5064-3: GNU cpio vulnerability

USN-5064-1 fixed a vulnerability in GNU. This update provides the corresponding update for Ubuntu 14.04 LTS. Original advisory details: Maverick Chung and Qiaoyi Fang discovered that cpio incorrectly handled certain pattern files. A remote attacker could use this issue to cause cpio to crash,...

Debian dla-3512 : linux-config-5.10 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3512 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3512-1 [email protected]...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS : Vim vulnerabilities (USN-6270-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6270-1 advisory. It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : poppler vulnerabilities (USN-6273-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6273-1 advisory. Jieyong Ma discovered that poppler incorrectly handled certain malformed PDF files. A remote attacker could possibly use this issue t...

USN-6269-1: GStreamer Good Plugins vulnerability

It was discovered that GStreamer Good Plugins incorrectly handled certain FLAC image tags. A remote attacker could use this issue to cause GStreamer Good Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2023-37327...

Ubuntu 20.04 LTS : Firefox vulnerabilities (USN-6267-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6267-1 advisory. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially explo...

Ubuntu: Security Advisory (USN-6263-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : OpenJDK vulnerabilities (USN-6263-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6263-1 advisory. Motoyasu Saburi discovered that OpenJDK incorrectly handled special characters in file name parameters. An...

Debian dla-3510 : thunderbird - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3510 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3510-1 [email protected] https://www.debian.org/lts/security/...

USN-6261-1: Linux kernel (IoT) vulnerabilities

It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-3090 Sh...

Debian dla-3509 : libmail-dkim-perl - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3509 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3509-1 [email protected] https://www.debian.org/lts/security/...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to server-side request forgery due to [CVE-2023-28155]

Summary Node.js module Request is used by IBM App Connect Enterprise Certified Container operands for both internal and external HTTP calls. IBM App Connect Enterprise Certified Container operands are vulnerable to server-side request forgery. This bulletin provides patch information to address t...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to privilege elevation due to [CVE-2023-26604]

Summary systemd is not used directly by IBM App Connect Enterprise Certified Container but is in the images as part of the base operating system. IBM App Connect Enterprise Certified Container operands are vulnerable to privilege elevation. This bulletin provides patch information to address the...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to security restriction bypass due to [CVE-2023-24329]

Summary Python is used by IBM App Connect Enterprise Certified Container for mapping assistance, and is present in the images as part of the base operating system. IBM App Connect Enterprise Certified Container operands are vulnerable to security restriction bypass. This bulletin provides patch...

USN-6256-1: Linux kernel (IoT) vulnerabilities

Jiasheng Jiang discovered that the HSA Linux kernel driver for AMD Radeon GPU devices did not properly validate memory allocation in certain situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service system crash. CVE-2022-3108...