Security Bulletin: IBM MQ Appliance is affected by a denial of service vulnerability (CVE-2021-38958)

Summary IBM MQ Appliance has resolved a denial of service vulnerability. Vulnerability Details CVEID: CVE-2021-38958 DESCRIPTION: IBM MQ Appliance is affected by a denial of service attack caused by a concurrency issue. CVSS Base score: 5.1 CVSS Temporal Score: See:...

Ubuntu 20.04 LTS : ICU vulnerability (USN-5156-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5156-1 advisory. It was discovered that ICU contains a double free issue. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. Tenable...

Debian DLA-2827-1 : bluez - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2827 advisory. Several vulnerabilities were discovered in BlueZ, the Linux Bluetooth protocol stack. An attacker could cause a denial-of-service DoS or leak information...

Debian DLA-2832-1 : opensc - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2832 advisory. - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decodebitstring in libopensc/asn1.c. CVE-2019-15945 - OpenSC before 0.20.0-rc1 has ...

Debian DLA-2830-1 : tar - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2830 advisory. An infinite loop when --sparse is used with file shrinkage during read access was fixed in the GNU tar archiving utility. For Debian 9 stretch, this problem has been fixed ...

[SECURITY] [DLA 2831-1] libntlm security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2831-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk November 28, 2021 https://wiki.debian.org/LTS -...

USN-5151-2: Mailman vulnerabilities

USN-5151-1 fixed several vulnerabilities in Mailman. This update provides the corresponding update for Ubuntu 20.04 ESM. Original advisory details: It was discovered that Mailman incorrectly handled certain URL. An attacker could possibly use this issue to execute arbitrary code. CVE-2021-43331 I...

USN-5156-1: ICU vulnerability

It was discovered that ICU contains a double free issue. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code...

Vulnerabilities fixed in Roundcube Webmail

Roundcube has fixed vulnerabilities in Webmail and Webmail LTS. The vulnerabilities allow a malicious party to launch a cross-site scripting attack, or to perform an SQL injection execute and thus gain access to the data in the underlying database. Roundcube has released updates to address the...

USN-5154-1: FreeRDP vulnerabilities

It was discovered that FreeRDP incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code or cause a crash. CVE-2021-41159 It was discovered that FreeRDP incorrectly handled certain connections. An attacker could possibly use this issue to execute...

Debian DLA-2825-1 : libmodbus - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2825 advisory. Two issues have been found in libmodbus, a library for the Modbus protocol. Both issues are related to out of bound reads, which could result in a denial of servic...

Debian DLA-2826-1 : mbedtls - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2826 advisory. Several vulnerabilities were discovered in mbed TLS, a lightweight crypto and SSL/TLS library, which could result in denial of service, information disclosure or...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.301.1.2.el7 - Revert 'net/rds: Allocate pages on HCA NUMA nodeid' Gerd Rausch Orabug: 33561324 - Revert 'net/rds: Allocate rdsibincoming,fragslab on HCA NUMA nodeid' Gerd Rausch Orabug: 33561324 - Revert 'net/rds: Use the same vector for send & receive' Gerd Rausch Orabug: 33561324 -...

USN-5153-1: LibreOffice vulnerabilities

It was discovered that LibreOffice incorrectly handled digital signatures. An attacker could possibly use this issue to create a specially crafted document that would display a validly signed indicator, contrary to expectations...

Aimeos Laravel Ecommerce Platform 2021.10 LTS SQL Injection

Exploit Title: Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection Date: 20/11/2021 Exploit Author: Ilker Burak ADIYAMAN Vendor Homepage: https://aimeos.org Software Link: https://aimeos.org/laravel-ecommerce-package Version: Aimeos 2021.10 LTS Tested on: MacOSX Description: The...

[SECURITY] [DLA 2824-1] firebird3.0 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2824-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler November 20, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2823-1 : salt - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2823 advisory. - An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and sourcehash URLs can gain full file system access as root on a salt...

Debian DLA-2824-1 : firebird3.0 - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2824 advisory. - An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement. CVE-2017-11509 Note th...

Heap-based Buffer Overflow in vim/vim

Description Greetings, A Heap-based Buffer Overflow issue was discovered in Vim. The POC file is reduced to the absolute minimum to reproduce the problem. Please see sanitizer output and the "trimmed" POC file link below. System info OS version : Ubuntu 20.04.2 LTS + Clang 12 with ASan Vim Versio...

java-17-openjdk security update

1:17.0.1.0.12-2 - Extend LTS check to exclude EPEL. - Related: rhbz2013841 1:17.0.1.0.12-2 - Set LTS designator. - Related: rhbz2013841 1:17.0.1.0.12-1 - Drop JDK-8272332/RH2004078 patch which is upstream in 17.0.1 - Resolves: rhbz2013841 1:17.0.1.0.12-1 - October CPU update to jdk 17.0.1+12 -...