CVE-2019-11277: Volume Services is vulnerable to an LDAP injection attack | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Description Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance...

CVE-2019-3689

The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If...

CVE-2019-3689

The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If...

CVE-2019-3689

The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If...

UBUNTU-CVE-2019-3689

The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If...

Design/Logic Flaw

The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If...

CVE-2019-3689

The CVE-2019-3689 issue affects the nfs-utils package on SUSE Linux Enterprise Server 12 (≤1.3.0-34.18.1) and SLES 15 (≤2.1.1-6.10.2). The directory /var/lib/nfs is owned by statd:nogroup, while files inside are root-owned. If statd is compromised, a process with root privileges could be tricked ...

CVE-2019-3689 nfs-utils: root-owned files stored in insecure /var/lib/nfs directory

The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If...

CVE-2019-3689

The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If...

Amazon Linux AMI : kernel (ALAS-2019-1281)

A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4.19.69, and 5.2.x through 5.2.11. Misuse of the upstream 'x86/ptrace: Fix possible spectre-v1 in ptracegetdebugreg' commit reintroduced the...

EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2019-1926)

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the...

EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1919)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The xfsbmapextentstobtree function in fs/xfs/libxfs/xfsbmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence

A flaw was found in the Linux kernel's NFS implementation. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the...

RHEL 7 : kernel (RHSA-2019:2696)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2696 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Memory corruption due to...

CVE-2019-15938

Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfsreadlinkreq in fs/nfs.c because a length field is directly used for a memcpy...

Security update for qemu (important)

openSUSE Security Update: Security update for qemu Announcement ID: openSUSE-SU-2019:2059-1 Rating: important References: 1079730 1098403 1111025 1119115 1134883 1135902 1136540 1136778 1140402 1143794 Cross-References: CVE-2019-12155 CVE-2019-13164 CVE-2019-14378 Affected Products: openSUSE Leap...

CVE-2019-15538

A flaw was found in the XFS file system in the Linux kernel. An acquired ILOCK was not freed/unlock when the call to xfsqmvopchownreserve fails and the lock is still held and can lead to denial to access for that device. This is primarily a local denial of service but could result in a remote...

CVE-2019-10054

An issue was discovered in Suricata 4.1.3. The function processreplyrecordv3 lacks a check for the length of reply.data. It causes an invalid memory access and the program crashes within the nfs/nfs3.rs file...

Security feature bypass

An issue was discovered in Suricata 4.1.3. The function processreplyrecordv3 lacks a check for the length of reply.data. It causes an invalid memory access and the program crashes within the nfs/nfs3.rs file...