Debian DLA-2699-1 : ipmitool - LTS security update

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2699 advisory. An issue has been found in ipmitool, an utility for IPMI control with kernel driver or LAN interface. Neglecting proper checking of input data might result in buffer...

Debian DLA-2700-1 : htmldoc - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2700 advisory. A buffer overflow was discovered in HTMLDOC, a HTML processor that generates indexed HTML, PS, and PDF, which could potentially result in the execution of arbitrar...

Debian DLA-2698-1 : node-bl - LTS security update

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2698 advisory. - A buffer over-read vulnerability exists in bl 4.0.3, 3.0.1, 2.2.1, and 1.2.3 which could allow an attacker to supply user input even typed that if it ends up in consume...

[SECURITY] [DLA 2698-1] node-bl security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2698-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz July 01, 2021 https://wiki.debian.org/LTS -...

CVE-2021-21671

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login...

Design/Logic Flaw

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login...

CVE-2021-21671

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login...

CVE-2021-21671

CVE-2021-21671 affects Jenkins 2.299 and earlier (including LTS 2.289.1 and earlier), where the system does not invalidate the previous session on login, enabling session fixation. Exploitation could allow a remote attacker with social engineering to gain administrator access. Remediation: upgrad...

CVE-2021-21670

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission...

Debian DLA-2697-1 : fluidsynth - LTS security update (deprecated)

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-21417. Reason: This candidate is a duplicate of CVE-2021-21417. Notes: All CVE users should reference CVE-2021-21417 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

Debian DLA-2696-1 : libjdom2-java - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2696 advisory. It was discovered that there was an XML External Entity XXE issue in libjdom2-java, a library for reading and manipulating XML documents. Attackers could have caused a deni...

USN-5000-2: Linux kernel (KVM) vulnerabilities

USN-5000-1 fixed vulnerabilities in the Linux kernel for Ubuntu 20.04 LTS and the Linux HWE kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux KVM kernel for Ubuntu 20.04 LTS. Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of...

Ubuntu 18.04 LTS : Thunderbird vulnerabilities (USN-4995-2)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4995-2 advisory. USN-4995-1 fixed vulnerabilities in Thunderbird. This update provides the corresponding updates for Ubuntu 18.04 LTS. Tenable has extracted the preceding...

Ubuntu 20.04 LTS : Ceph vulnerabilities (USN-4998-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4998-1 advisory. It was discovered that in some situations Ceph logged passwords from the mgr module in clear text. An attacker could use this to expose sensitive...

USN-5004-1 rabbitmq-server vulnerabilities

It was discovered that RabbitMQ incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. CVE-2019-11287 Jonathan Knudsen discovered RabbitMQ incorrectly handled certain inputs. An...

in lavv17/lftp

✍️ Description Whilst testing lftp built from commit d67fc1 with Clang 13 +ASan on Ubuntu 20.04.2 LTS, we discovered a crafted file which triggers a null pointer dereference and segfault. 🕵️‍♂️ Proof of Concept echo "aiYgAQEBNA==" | base64 -d /tmp/file.fuzz && ./lftp -f /tmp/file.fuzz The above POC...

USN-5001-1: Linux kernel (OEM) vulnerabilities

Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel leading to multiple use-after-free vulnerabilities. A local attacker could use this issue to execute arbitrary code. CVE-2021-3609 Mathy Vanhoef discovered that the Linux kernel’s WiFi implementati...

[SECURITY] [DLA 2689-1] linux security update

Debian LTS Advisory DLA-2689-1 [email protected] https://www.debian.org/lts/security/ Ben Hutchings June 22, 2021 https://wiki.debian.org/LTS Package : linux Version : 4.9.272-1 CVE ID : CVE-2020-24586 CVE-2020-24587 CVE-2020-24588 CVE-2020-25670 CVE-2020-25671 CVE-2020-25672...

Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5001-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5001-1 advisory. Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel leading to multiple use-after-free vulnerabilities. A...

Ubuntu 16.04 ESM / 18.04 LTS : Linux kernel vulnerabilities (USN-5003-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5003-1 advisory. Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel leading to multiple use-after-free...