CVE-2020-10937

CVE-2020-10937 affects IPFS (go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and abuse the IPFS connection management reputation system to poison routing tables, allowing eclipse of target nodes from the network. The primary details in the sources indicate this is a networ...

Debian DLA-2422-1 : qtsvg-opensource-src security update

Malformed SVG images were able to cause a segmentation fault in qtsvg-opensource-src, the QtSvg module for displaying the contents of SVG files in Qt. For Debian 9 stretch, this problem has been fixed in version 5.7.120161021-2.1. We recommend that you upgrade your qtsvg-opensource-src packages...

Debian DLA-2412-2 : openjdk-8 regression update

A few issues have been found in the OpenJDK 8u272 update, including LDAP connection failures and application crash. For Debian 9 stretch, this problem has been fixed in version 8u275-b01-1deb9u1. We recommend that you upgrade your openjdk-8 packages. For the detailed security status of openjdk-8...

Fedora 33 : thunderbird (2020-25247f0fe7)

Update to latest upstream version. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Netwo...

CVE-2020-5657

The CVE-2020-5657 issue affects MELSEC iQ-R firmware and is caused by improper neutralization of argument delimiters in a TCP/IP function. A crafted packet from an adjacent network could cause a denial-of-service condition or stop network functions on affected modules: RJ71EIP91 (EtherNet/IP), RJ...

CVE-2020-5653

CVE-2020-5653 is a buffer overflow in the MELSEC iQ-R firmware TCP/IP stack (affecting EtherNet/IP RJ71EIP91, PROFINET RJ71PN92, RD81DL96, RD81MES96N, RD81OPC96). Root cause: improper restriction within the bounds of a memory buffer. Impact per sources: remote attacker can stop network functions ...

Fedora 31 : python2 (2020-e33acdea18)

Fix CVE-2020-26116: Reject control chars in HTTP method in httplib Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

EulerOS 2.0 SP5 : python-rsa (EulerOS-SA-2020-2267)

According to the version of the python-rsa package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., ...

EulerOS 2.0 SP5 : python-lxml (EulerOS-SA-2020-2296)

According to the versions of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scriptin...

EulerOS 2.0 SP5 : bind (EulerOS-SA-2020-2278)

According to the version of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In BIND 9.0.0 - 9.11.21, 9.12.0 - 9.16.5, 9.17.0 - 9.17.3, also affects 9.9.3-S1 - 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on...

EulerOS 2.0 SP5 : lldpad (EulerOS-SA-2020-2290)

According to the version of the lldpad package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an...

Fedora 33 : tcpreplay (2020-c50d8b980b)

Patch CVE-2020-24265 and CVE-2020-24266. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable...

Fedora 31 : tcpreplay (2020-e45cf8ea43)

Patch CVE-2020-24265 and CVE-2020-24266. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable...

Back to the future: What the Jericho Forum taught us about modern security

Some of the earliest formal work on what we now call Zero Trust started around in a security consortium known as the Jericho Forum which later merged into The Open Group Security Forum. This started as a group of like-minded CISOs wrestling with the limitations of the dominant and unquestioned...

Back to the future: What the Jericho Forum taught us about modern security

Some of the earliest formal work on what we now call Zero Trust started around in a security consortium known as the Jericho Forum which later merged into The Open Group Security Forum. This started as a group of like-minded CISOs wrestling with the limitations of the dominant and unquestioned...

CVE-2019-8834

The CVE-2019-8834 entry affects Apple’s CFNetwork (and related iCloud/WebKit contexts in Apple OS releases). Description: a configuration issue may allow an attacker in a privileged network position to bypass HSTS for a limited set of top‑level domains not previously in the HSTS preload list. Aff...

CVE-2019-8834

A configuration issue was addressed with additional restrictions. This issue is fixed in tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra, iOS 13.3 and iPadOS 13.3, iTunes 12.10.3 for Windows, iClo...

CVE-2019-8564

CVE-2019-8564 describes a logic issue resolved by improved validation, fixed in macOS Mojave 10.14.4 and Security Update 2019-002 for High Sierra/Sierra. An attacker in a privileged network position could modify driver state. The initial description provides affected platforms and the remediation...

Trend Micro HouseCall for Home Networks: Giving You a Free Hand in Home Network Security

Remember when only desktop computers in our homes had connections to the internet? Thanks to the latest developments in smart device technology, almost everything now can be connected— security cameras, smart TVs, gaming consoles, and network storage, to name just a few. While a home network...

Ubuntu 20.10 : PHP vulnerabilities (USN-4583-2)

The remote Ubuntu 20.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4583-2 advisory. Several security issues were fixed in PHP. Tenable has extracted the preceding description block directly from the Ubuntu security advisory. Note that Nessus...