Ubuntu 16.04 LTS / 18.04 LTS : libiberty vulnerabilities (USN-4326-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4326-1 advisory. It was discovered that libiberty incorrectly handled parsing certain binaries. If a user or automated system were tricked into processing a...

CVE-2020-8832

The CVE-2020-8832 entry concerns the Ubuntu 18.04 LTS Linux kernel where the fix for CVE-2019-14615 (clearing data structures on context switches for certain Intel graphics processors) was incomplete. The vulnerability affects kernels prior to 4.15.0-91.92, enabling a local attacker to expose sen...

[SECURITY] [DLA 2171-1] ceph security update

Package : ceph Version : 0.80.7-2+deb8u4 CVE ID : CVE-2020-1760 Debian Bug : 956142 It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. For Debian 8 "Jessie", this issue has been fixed in ceph version 0.80.7-2+deb8u4. We recommend that...

CVE-2020-8832: Exposure of Sensitive Information to an Unauthorized Actor

The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 "The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors." was discovered to be incomplete, meaning that in versions of the kernel before 4.15.0-91.92, an attacker could u...

[SECURITY] [DLA 2170-1] firefox-esr security update

Package : firefox-esr Version : 68.7.0esr-1deb8u1 CVE ID : CVE-2020-6819 CVE-2020-6820 CVE-2020-6821 CVE-2020-6822 CVE-2020-6825 Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code. For Debian 8 "Jessie",...

Ubuntu 18.04 LTS : HAProxy vulnerability (USN-4321-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4321-1 advisory. Felix Wilhelm discovered that HAProxy incorrectly handled certain HTTP/2 requests. An attacker could possibly use this to execute arbitrary code. Tenable has...

PT-2020-10612 · Varnish +6 · Varnish Cache +6

Name of the Vulnerable Software and Affected Versions: Varnish Cache versions prior to 6.0.5 LTS Varnish Cache versions 6.1.x through 6.2.1 Varnish Cache versions 6.3.x through 6.3.0 Description: An issue was discovered in Varnish Cache where it does not clear a pointer between the handling of on...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4325-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4325-1 advisory. It was discovered that the IPMI message handler implementation in the Linux kernel did not properly deallocate memory in certain situations. A local...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4319-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4319-1 advisory. It was discovered that the IPMI message handler implementation in the Linux kernel did not properly deallocate memory in certain situations. A local...

Ubuntu 16.04 LTS / 18.04 LTS : Firefox vulnerabilities (USN-4317-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4317-1 advisory. Two use-after-free bugs were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could explo...

[ASA-202004-3] linux-lts: privilege escalation

Arch Linux Security Advisory ASA-202004-3 ========================================= Severity: High Date : 2020-04-01 CVE-ID : CVE-2020-8835 Package : linux-lts Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1121 Summary ======= The package linux-lts before versi...

[SECURITY] [DLA 2163-1] tinyproxy security update

Package : tinyproxy Version : 1.8.3-3+deb8u1 CVE ID : CVE-2017-11747 Debian Bug : 870307 948283 A minor security issue and a severe packaging bug have been fixed in tinyproxy, a lightweight http proxy daemon. CVE-2017-11747 main.c in Tinyproxy created a /var/run/tinyproxy/tinyproxy.pid file after...

Ubuntu 18.04 LTS : Linux kernel vulnerability (USN-4313-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4313-1 advisory. Manfred Paul discovered that the bpf verifier in the Linux kernel did not properly calculate register bounds for certain operations. A local attacker could use th...

Ubuntu 18.04 LTS : WebKitGTK+ vulnerability (USN-4310-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4310-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote...

Debian: Security Advisory (DLA-2160-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2159-1] okular security update

Package : okular Version : 4:4.14.2-2+deb8u2 CVE ID : CVE-2020-9359 Debian Bug : 954891 Mickael Karatekin from Sysdream Labs discovered that the Okular document viewer allows code execution via an action link in a PDF document. For Debian 8 "Jessie", this problem has been fixed in version...

CVE-2020-2161

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels...

CVE-2020-2162

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability...

Cross site scripting

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers...

CVE-2020-2163

CVE-2020-2163 affects Jenkins 2.227 and earlier, and Jenkins LTS 2.204.5 and earlier. The issue is a stored XSS in the HTML content of list view column headers, caused by improper processing. It can be exploited by a user who can control column headers, enabling script execution in a victim’s bro...