Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerability (USN-5346-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5346-1 advisory. It was discovered that the ICMPv6 implementation in the Linux kernel did not properly deallocate memory in certain situations. A remote attacker could possibly us...

CVE-2022-22316

CVE-2022-22316 relates to IBM MQ Appliance where an authenticated user could cause a denial of service due to incorrectly configured authorization checks on the IBM MQ appliance’s clustering/authorization logic. The primary affected delivery is IBM MQ Appliance 9.2 CD and 9.2 LTS. IBM’s bulletin ...

USN-5340-1: CKEditor vulnerabilities

Kyaw Min Thein discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS. CVE-2018-9861 Micha Bentkowski discovered that CKEditor incorrectly handled certain inputs. An attacker could...

Use After Free in new_object

Description Heap use after free in newobject function. ASAN report： ================================================================= ==2514600==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020000401d0 at pc 0x00000230a00e bp 0x7ffcfdbe1dd0 sp 0x7ffcfdbe1dc8 READ of size 2 at...

[SECURITY] [DLA 2960-1] apache2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2960-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort March 22, 2022 https://wiki.debian.org/LTS -...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5337-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5337-1 advisory. It was discovered that the BPF verifier in the Linux kernel did not properly restrict pointer types in certain situations. A local attacker could use thi...

Ubuntu 16.04 ESM : GNU binutils vulnerabilities (USN-5341-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5341-1 advisory. It was discovered that GNU binutils incorrectly handled checks for memory allocation when parsing relocs in a corrupt file. An attacker could possibly us...

Debian DLA-2960-1 : apache2 - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2960 advisory. Several vulnerabilities have been discovered in the Apache HTTP server, which could result in denial of service, request smuggling or buffer overflows. For Debian ...

Debian DLA-2961-1 : thunderbird - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2961 advisory. Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code or information disclosure. For Debian 9 stretch, the...

Debian DLA-2936-1 : libgit2 - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2936 advisory. Multiple vulnerabilities were found in libgit2, a low-level Git library, and are as follows: CVE-2018-8098 Integer overflow in the index.c:readentry function while...

Debian DLA-2957-1 : libpano13 - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2957 advisory. It was discovered that Panorama Tools, a toolkit to generate, edit and transform many kinds of panoramic images, contained an out-of-bounds read vulnerability which could...

Debian DLA-2959-1 : paramiko - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2959 advisory. - In Paramiko before 2.10.1, a race condition between creation and chmod in the writeprivatekeyfile function could allow unauthorized information disclosure. CVE-2022-24302...

Debian DLA-2956-1 : wordpress - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2956 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 70300 C Tenable Network Security...

Debian DLA-2955-1 : bind9 - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2955 advisory. It was found that bind9, an internet domain name server, was vulnerable to cache poisoning. When using forwarders, bogus NS records supplied by, or via, those forwarders ma...

Debian DLA-2954-1 : python-treq - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2954 advisory. - treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods treq.get, treq.post, etc. and treq.client.HTTPClient construct...

USN-5321-2: Firefox vulnerabilities

USN-5321-1 fixed vulnerabilities in Firefox. The update didn't include arm64 because of a regression. This update provides the corresponding update for arm64. This update also removes Yandex and Mail.ru as optional search providers in the drop-down search menu. Original advisory details: Multiple...

Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5321-2)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5321-2 advisory. USN-5321-1 fixed vulnerabilities in Firefox. The update didn't include arm64 because of a regression. This update provides the corresponding...

Debian DLA-2952-1 : openssl - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2952 advisory. - There is an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests...

Debian DLA-2951-1 : flac - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2951 advisory. - In appendtoverifyfifointerleaved of streamencoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosur...

[SECURITY] [DLA 2950-1] python-scrapy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2950-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort March 16, 2022 https://wiki.debian.org/LTS -...