Debian DLA-2346-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or unintended or malicious extensions being installed. For Debian 9 stretch, these problems have been fixed in version 68.12.0esr-1deb9u1. We recommend th...

EulerOS 2.0 SP8 : icedtea-web (EulerOS-SA-2020-1856)

According to the versions of the icedtea-web package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising th...

EulerOS 2.0 SP8 : libreswan (EulerOS-SA-2020-1865)

According to the version of the libreswan package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Before 3.28 Libreswan, assertion failure may lead to Pluto IKE daemon restart.An attacker can through 3 descbc mode to send two IKEv2 data to the...

EulerOS 2.0 SP8 : nasm (EulerOS-SA-2020-1870)

According to the versions of the nasm package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Netwide assembler NASM 2.14 rc15 in asm/preproc. C the expandmmacparams a heap-based buffer, the buffer read is insufficient, lead to insufficient...

EulerOS 2.0 SP8 : java-1.8.0-openjdk (EulerOS-SA-2020-1858)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development...

EulerOS 2.0 SP8 : sqlite (EulerOS-SA-2020-1883)

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a...

EulerOS Virtualization for ARM 64 3.0.6.0 : PyYAML (EulerOS-SA-2020-1912)

According to the version of the PyYAML package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code...

Fedora 32 : 1:wireshark (2020-7f91f10f2b)

New version 3.2.6, Security fix for CVE-2020-17498 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues....

EulerOS 2.0 SP8 : python-rsa (EulerOS-SA-2020-1878)

According to the version of the python-rsa packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g.,...

USN-4476-1: NSS vulnerability

It was discovered that NSS incorrectly handled some inputs. An attacker could possibly use this issue to expose sensitive information...

USN-4476-1 nss vulnerability

It was discovered that NSS incorrectly handled some inputs. An attacker could possibly use this issue to expose sensitive information...

Fedora 32 : firejail (2020-45fc8559d5)

Rebase to version 0.9.62.4 ---- Rebase to version 0.9.62.2 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

CVE-2020-14498

CVE-2020-14498 affects HMS Industrial Networks AB eCatcher (VPN client). All versions before 6.5.5 are vulnerable to a stack-based buffer overflow in the eCatcher component, which may allow an attacker to remotely execute arbitrary code. Affected versions are explicitly listed as prior to 6.5.5; ...

SUSE SLES12 Security Update : xorg-x11-server (SUSE-SU-2020:2242-1)

This update for xorg-x11-server fixes the following issues : CVE-2020-14347: Leak of uninitialized heap memory from the X server to clients on pixmap allocation bsc1174633, ZDI-CAN-11426. CVE-2020-14346: XIChangeHierarchy Integer Underflow Privilege Escalation Vulnerability bsc1174638,...

[SECURITY] Fedora 31 Update: nss-3.55.0-1.fc31

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

Debian DLA-2342-1 : libjackson-json-java security update

Several vulnerabilities were fixed in libjackson-json-java, a Java JSON processor. CVE-2017-7525 Jackson Deserializer security vulnerability. CVE-2017-15095 Block more JDK types from polymorphic deserialization. CVE-2019-10172 XML external entity vulnerabilities. For Debian 9 stretch, these...

Fedora: Security Advisory for nss (FEDORA-2020-426fd04fd0)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 31 : nss (2020-426fd04fd0)

Updates the nss package to upstream NSS 3.55. For details about new functionality and a list of bugs fixed in this release please see the upstream release notes - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS3.55releasenotes Note that Tenable Network Security has extracted the...

CVE-2020-24613

WolfSSL prior to 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_DECL/WAIT_CERT_CERT state within SanityCheckTls13MsgReceived() in tls13.c, representing an incorrect implementation of the TLS 1.3 client state machine. This can enable a privileged network attacker to impersonate TLS 1.3 serv...

Debian DLA-2336-1 : firejail security update

Tim Starling discovered two vulnerabilities in firejail, a sandbox program to restrict the running environment of untrusted applications. CVE-2020-17367 It was reported that firejail does not respect the end-of-options separator '--', allowing an attacker with control over the command line option...