CVE-2020-27911

An integer overflow was addressed through improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, tvOS 14.2, iTunes 12.11 for Windows. A remote attacker may be able to cause unexpected application termination or...

Memory corruption

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7...

CVE-2020-9943

CVE-2020-9943 is an out-of-bounds read in Apple’s Audio stack (CoreAudio) that could allow a malicious app to read restricted memory. It was addressed by improved bounds checking and memory handling. The fixed versions include macOS Big Sur 11.0.1, iOS 14.0 and iPadOS 14.0, watchOS 7.0, and tvOS ...

Multiple Apple Product Licensing Issues Vulnerabilities

Apple macOS Mojave and others are a set of specialized operating systems developed for Mac computers by the American company Apple. A security vulnerability exists in several Apple versions, which stems from the handling of malicious emails that could lead to the writing of arbitrary files. The...

Embedded TCP/IP stacks have memory corruption vulnerabilities

Overview Multiple open-source embedded TCP/IP stacks, commonly used in Internet of Things IoT and embedded devices, have several vulnerabilities stemming from improper memory management. These vulnerabilities are also tracked as ICS-VU-633937 and JVNVU96491057 as well as the name AMNESIA:33...

CVE-2020-17521

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

Code injection

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

CVE-2020-17521

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

CVE-2020-17521

CVE-2020-17521 affects Apache Groovy extension methods that handle temporary directory creation. The root cause is a race condition in Groovy’s implementation, which previously called a now-superseded Java JDK method; this could allow a local attacker to obtain sensitive information. Affected ver...

Protect Yourself from Holiday Cyber Threats – Ask the Howlers, Episode 16 Highlights

In episode 16 of “Ask the Howlers,” host Stacia Tympanick, senior solution engineer, met up with Ryan Hendricks, staff architect and manager, to discuss the latest topics concerning cybersecurity impacting the online holiday shopping season. Check out some highlights from the discussion and gain...

Apache Groovy security vulnerabilities

Apache Groovy is the United States Apache Apache Software Foundation of a Java-based platform for object-oriented programming language, which combines many powerful features of Python, Ruby and Smalltalk. A resource management error vulnerability exists in the Apache Groovy provides product that...

Insecure Service Initialization

firefox does not perform secure service initialization. OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. Note: This issue only affected Firefox for Android. Other operating...

Text Services Framework Unauthorized Access

The vulnerability of the Text Services Framework software interface in Windows operating systems is related to incorrect handling of objects in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Remote Desktop Protocol Server Unauthorized Access

The vulnerability of the Remote Desktop Protocol Server for Windows operating systems relates to operations that occur outside of the buffer. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information from a remote location...

Windows Backup Service Privilege Escalation

The vulnerability of the Windows Backup Service in operating systems involves improper handling of file operations. Exploiting this vulnerability can allow an attacker to increase their privileges...

Network File System Windows Unauthorized Access

The vulnerability of the Network File System NFS on Windows operating systems relates to operations that occur outside the buffer boundaries. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2020-26235

In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected...

ALPINE-CVE-2020-26235

In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected...

CVE-2020-26235 Segmentation fault in Rust time crate

In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected...

Windows Update Orchestrator Service Privilege Escalation

The vulnerability of the Windows Update Orchestrator Service component in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...