Ubuntu 18.04 LTS : uriparser vulnerabilities (USN-5172-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5172-1 advisory. It was discovered that uriparser mishandled certain input. An attacker could use this vulnerability to cause uriparser to crash or possibly execute...

Ubuntu 18.04 LTS / 20.04 LTS : BusyBox vulnerabilities (USN-5179-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5179-1 advisory. It was discovered that BusyBox incorrectly handled certain malformed gzip archives. If a user or automated system were tricked into processin...

USN-5178-1: Django vulnerability

Sjoerd Job Postmus and TengMA discovered that Django incorrectly handled URLs with trailing newlines. A remote attacker could possibly use this issue to bypass certain access controls...

Ubuntu: Security Advisory (USN-5170-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 20.04 LTS : Samba regressions (USN-5142-2)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5142-2 advisory. USN-5142-1 fixed vulnerabilities in Samba. Some of the upstream changes introduced regressions in name mapping and backups. Please see the following upstream bugs...

USN-5170-1: MariaDB vulnerability

A security issue was discovered in MariaDB and this update includes new upstream MariaDB versions to fix the issue. MariaDB has been updated to 10.3.32 in Ubuntu 20.04 LTS and to 10.5.13 in Ubuntu 21.04 and Ubuntu 21.10. In addition to security fixes, the updated packages contain bug fixes, new...

Debian DLA-2837-1 : gmp - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2837 advisory. - GNU Multiple Precision Arithmetic Library GMP through 6.2.1 has an mpz/inpraw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentatio...

Debian DLA-2834-1 : uriparser - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2834 advisory. - URIFUNC in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read in uriParseEx functions for an incomplete URI with an IPv6 address containing an embedded IPv4...

Debian DLA-2833-1 : rsync - LTS security update

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2833 advisory. - The parsearguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an...

Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5165-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5165-1 advisory. It was discovered that the NFC subsystem in the Linux kernel contained a use-after-free vulnerability in its NFC Controller Interface NCI implementation....

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5161-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5161-1 advisory. Ilja Van Sprundel discovered that the SCTP implementation in the Linux kernel did not properly perform size validations on incoming packets in some...

Ubuntu 16.04 ESM / 18.04 LTS : Linux kernel vulnerabilities (USN-5164-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5164-1 advisory. It was discovered that the Option USB High Speed Mobile device driver in the Linux kernel did not properly handle error conditions. A...

USN-5165-1: Linux kernel (OEM) vulnerabilities

It was discovered that the NFC subsystem in the Linux kernel contained a use-after-free vulnerability in its NFC Controller Interface NCI implementation. A local attacker could possibly use this to cause a denial of service system crash or execute arbitrary code. CVE-2021-3760 It was discovered...

USN-5163-1: Linux kernel vulnerabilities

Ilja Van Sprundel discovered that the SCTP implementation in the Linux kernel did not properly perform size validations on incoming packets in some situations. An attacker could possibly use this to expose sensitive information kernel memory. CVE-2021-3655 It was discovered that the Option USB Hi...

USN-5162-1: Linux kernel vulnerabilities

Ilja Van Sprundel discovered that the SCTP implementation in the Linux kernel did not properly perform size validations on incoming packets in some situations. An attacker could possibly use this to expose sensitive information kernel memory. CVE-2021-3655 It was discovered that the AMD...

CVE-2021-38967

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local privileged user to inject and execute malicious code. IBM X-Force ID: 212441...

Information disclosure

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. IBM X-Force ID: 213215...

CVE-2021-38967

CVE-2021-38967 affects IBM MQ Appliance (9.2 CD and 9.2 LTS). A vulnerability allows a local privileged user to inject and execute malicious code due to a code-injection flaw. The IBM Security Bulletin references APAR IT38788 as remediation. Possible mitigations include upgrading to IBM MQ Applia...

CVE-2021-38958

CVE-2021-38958 affects IBM MQ Appliance 9.2 CD and 9.2 LTS. The issue is a denial-of-service caused by a concurrency flaw in the appliance, leading to an availability impact. The vulnerability is documented with CVSS metrics (base score 5.5 in CVSS 3.1 with LOCAL, LOW complexity, HIGH availabilit...

None in fcambus/logswan

Description Good morning, I hope you're doing well today. Whilst testing logswan built with Clang12 + ASan on Ubuntu 20.04.3 LTS from commit bcfd41, we discovered a heap-use-after-free situation during a strcmp operation on line 259 of logswan/src/logswan.c. Proof of Concept First... echo...