SUSE SLED15 / SLES15 Security Update : xorg-x11-server (SUSE-SU-2020:3586-1)

This update for xorg-x11-server fixes the following issues : CVE-2020-25712: Fixed a heap-based buffer overflow which could have led to privilege escalation bsc1177596. CVE-2020-14360: Fixed an out of bounds memory accesses on too short request which could lead to denial of service bsc1174908. No...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:3122-1)

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb.c could be used by local attackers to corrupt memory, cause a NULL pointer...

SUSE SLED15 / SLES15 Security Update : python-cryptography (SUSE-SU-2020:3592-1)

This update for python-cryptography fixes the following issues : CVE-2020-25659: Attempted to mitigate Bleichenbacher attacks on RSA decryption bsc1178168. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

SUSE SLED15 / SLES15 Security Update : go1.14 (SUSE-SU-2020:3369-1)

This update for go1.14 fixes the following issues : go1.14.12 released 2020-11-12 includes security fixes to the cmd/go and math/big packages. - go42553 math/big: panic during recursive division of very large numbers bsc1178750 CVE-2020-28362 - go42560 cmd/go: arbitrary code can be injected into...

SUSE SLES12 Security Update : kernel (SUSE-SU-2020:3326-1)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bug fixes. The following security bugs were fixed : CVE-2020-25656: Fixed a concurrency use-after-free in vtdokdgkbioctl bnc1177766. CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in...

SUSE SLED15 / SLES15 Security Update : gnome-settings-daemon, gnome-shell (SUSE-SU-2020:3132-1)

This update for gnome-settings-daemon, gnome-shell fixes the following issues : gnome-settings-daemon : Add support for recent UCM related changes in ALSA and PulseAudio. jscSLE-16518 Don't warn when a default source or sink is missing and the PulseAudio daemon is restarting. jscSLE-16518 Don't...

SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2020:2800-1)

This update for nodejs8 fixes the following issues : CVE-2020-8174: Fixed multiple memory corruption in napigetvaluestring bsc1172443. CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames bsc1172442. CVE-2020-7598: Fixed an issue which could...

SUSE SLES12 Security Update : kernel (SUSE-SU-2020:3656-1)

This update for the Linux Kernel 4.4.180-94135 fixes several issues. The following security issues were fixed : CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE...

Embedded TCP/IP stacks have memory corruption vulnerabilities

Overview Multiple open-source embedded TCP/IP stacks, commonly used in Internet of Things IoT and embedded devices, have several vulnerabilities stemming from improper memory management. These vulnerabilities are also tracked as ICS-VU-633937 and JVNVU96491057 as well as the name AMNESIA:33...

Fedora 32 : fossil (2020-50be892d25)

Upgrade to fossil 2.12.1 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Securit...

Fedora 32 : xorg-x11-server (2020-c8a7df24d4)

Security fix for CVE-2020-14360, CVE-2020-25712 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C...

IBM DB2 10.5 < FP11 40479 / 11.1 < FP5 40478 / 11.5 < 11.5.5000.1587 Buffer Overflow (Windows)

A buffer overflow condition exists in IBM DB2 due to improper bounds checking. An unauthenticated, local attacker can exploit this to execute arbitrary code on the system with root privileges. Note that Nessus has not tested for this issue but has instead relied only on the application's...

Debian DLA-2477-1 : jupyter-notebook security update

It was discovered that there was an issue in the 'jupyter-notebook' interactive notebook system where a maliciously-crafted link could redirect the browser to a malicious/spoofed website. For Debian 9 'Stretch', this problem has been fixed in version 4.2.3-4+deb9u2. We recommend that you upgrade...

Fedora 32 : webkit2gtk3 (2020-e8a7566e80)

Update to WebKitGTK 2.30.3 : - Fix backdrop filters with rounded borders. - Fix scrolling iframes when async scrolling is enabled. - Allow applications to handle drag and drop on the web view again. - Update Outlook user agent quirk. - Fix several crashes and rendering issues. - Security fixes:...

Debian DLA-2473-1 : vips security update

In VIPS, an image processing system, an uninitialized variable which may cause the leakage of remote server path or stack address was fixed. For Debian 9 stretch, this problem has been fixed in version 8.4.5-1+deb9u2. We recommend that you upgrade your vips packages. For the detailed security...

Intelbras Router RF 301K 1.1.2 Authentication Bypass

Exploit Title: Intelbras Router RF 301K 1.1.2 - Authentication Bypass Date: 27/11/2020 Exploit Author: Kaio Amaral Vendor Homepage: https://www.intelbras.com/pt-br/ Software Link: http://backend.intelbras.com/sites/default/files/2020-10/RF301Kv1.1.2.zip Version: firmware version 1.1.2 Tested on:...

Fedora 33 : webkit2gtk3 (2020-145877bcd3)

Update to WebKitGTK 2.30.3 : - Fix backdrop filters with rounded borders. - Fix scrolling iframes when async scrolling is enabled. - Allow applications to handle drag and drop on the web view again. - Update Outlook user agent quirk. - Fix several crashes and rendering issues. - Security fixes:...

Debian DLA-2467-2 : lxml regression update

The fix for CVE-2020-27783, released as DLA 2467-1, was incomplete as the component was still affected by the vulnerability. This update includes an additional patch that completes the fix. Note that a package with version 3.7.1-1+deb9u2 was uploaded, but before the publication of the advisory a...

Fedora 32 : 2:microcode_ctl (2020-1afbe7ba2d)

Update to upstream 2.1-31. 20201118 - Removal of 06-8c-01/0x80 TGL-UP3/UP4 B1 microcode at revision 0x681; - Update of 06-7a-01/0x01 GLK B0 microcode from revision 0x32 up to 0x342. 1 The microcode has been removed after reports of system hangs:...

Fedora 32 : slurm (2020-98a5098030)

Update to 19.05.08. Closes security issues CVE-2020-27745 and CVE-2020-27746 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...