Ubuntu: Security Advisory (USN-4708-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4707-1: TCMU vulnerability

It was discovered that TCMU lacked a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4709-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4709-1 advisory. It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY requests. An...

Ubuntu 20.04 LTS : Ceph vulnerabilities (USN-4706-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4706-1 advisory. Olle Segerdahl found that ceph-mon and ceph-mgr daemons did not properly restrict access, resulting in gaining access to unauthorized resources. An...

Jenkins < 2.263.3 LTS / 2.276 TOCTOU

The version of Jenkins running on the remote web server is prior to 2.276 weekly or 2.263.3 LTS. It is, therefore, affected by a time-of-check to time-of-use TOCTOU race condition that allows reading arbitrary files using the file browser for workspaces and archived artifacts. Note that Nessus ha...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4708-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4708-1 advisory. Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly track inode validations. An attacker could use this to...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel regression (USN-4712-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4712-1 advisory. USN-4576-1 fixed a vulnerability in the overlay file system implementation in the Linux kernel. Unfortunately, that fix introduced a regression that...

CVE-2021-21615

Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use TOCTOU race condition...

CVE-2021-21615

Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use TOCTOU race condition...

Race condition

Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use TOCTOU race condition...

CVE-2021-21615

Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use TOCTOU race condition...

[SECURITY] [DLA 2532-1] debian-security-support security update

Debian LTS Advisory DLA-2532-1 [email protected] https://www.debian.org/lts/security/ Holger Levsen January 25, 2021 https://wiki.debian.org/LTS Package : debian-security-support Version : 1:9+2021.01.23 debian-security-support, the Debian security support coverage checker, has been...

Ubuntu 16.04 LTS : Pound vulnerabilities (USN-4702-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4702-1 advisory. It was discovered that Pound incorrectly handled certain HTTP requests A remote attacker could use it to retrieve some sensitive information...

openSUSE Security Update : nodejs10 (openSUSE-2021-65)

This update for nodejs10 fixes the following issues : - New upstream LTS version 10.23.1 : - CVE-2020-8265: use-after-free in TLSWrap High bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap objec...

openSUSE Security Update : nodejs14 (openSUSE-2021-66)

This update for nodejs14 fixes the following issues : - New upstream LTS version 14.15.4 : - CVE-2020-8265: use-after-free in TLSWrap High bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap objec...

[SECURITY] [DLA 2531-1] python-bottle security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2531-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta January 24, 2021 https://wiki.debian.org/LTS -...

OpenMage Magento Lts 路径遍历漏洞

OpenMage Magento Lts is an e-commerce system organized by OpenMage. A security vulnerability exists in OpenMage Magento Lts before versions 19.4.10 and 20.0.5, which originates from the fact that an administrator with privileges to import and export data and edit cms pages can inject executable...

Ubuntu 18.04 LTS / 20.04 LTS : NVIDIA graphics drivers vulnerabilities (USN-4689-3)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4689-3 advisory. It was discovered that the NVIDIA GPU display driver for the Linux kernel contained a vulnerability that allowed user-mode clients to access...

IBM MQ 9.0.0.0 LTS / 9.0.1 CD (560861)

The version of IBM MQ Server running on the remote host is affected by a vulnerability. IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to due to improper access controls. IBM X-Force ID: 117926. Note that...

[SECURITY] [DLA 2528-1] gst-plugins-bad1.0 security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2528-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta January 19, 2021 https://wiki.debian.org/LTS -...