MGASA-2021-0335 Updated php-smarty package fixes security vulnerabilities

Smarty before 3.1.39 allows a Sandbox Escape because $smarty.templateobject can be accessed in sandbox mode CVE-2021-26119. Smarty before 3.1.39 allows code injection via an unexpected function name after a function name= substring CVE-2021-26120...

Medium: bind

Issue Overview: Incremental zone transfers IXFR provide a way of transferring changed portions of a zone between servers. An IXFR stream containing SOA records with an owner name other than the transferred zone's apex may cause the receiving named server to inadvertently remove the SOA record for...

Important: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.6.35 packages update

Red Hat OpenShift Container Platform release 4.6.35 is now available with updates to packages and images that fix several bugs. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This...

SUSE: Security Advisory (SUSE-SU-2020:2477-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important Photon OS Security Update - PHSA-2021-3.0-0201

Updates of 'linux-aws', 'linux', 'linux-secure', 'glib', 'linux-esx', 'linux-rt', 'openldap' packages of Photon OS have been released...

Webmin <= 1.910 Remote Command Execution

A remote command execution vulnerability exists in Package Updates module. An authenticated, remote attacker can exploit this if they are authorized to the Package Updates module via the data parameter to update.cgi in order to execute arbitrary commands with root privileges. C Tenable Network...

FreeBSD : Gitlab -- multiple vulnerabilities (a2a2b34d-52b4-11eb-87cb-001b217b3468)

Gitlab reports : Ability to steal a user's API access token through GitLab Pages Prometheus denial of service via HTTP request with custom method Unauthorized user is able to access private repository information under specific conditions Regular expression denial of service in NuGet API Regular...

Updated imagemagick packages fix security vulnerabilities

The imagemagick package has been updated to version 7.0.10-55, fixing several security issues. The abydos, converseen, libopenshot, mgba, pfstools, php-imagick, sk1, synfig, transcode, uniconvertor, and xine-lib1.2 packages have been rebuilt against the updated libmagick library...

CVE-2020-35606

Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...

CVE-2020-35606

Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...

Command injection

Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...

CVE-2020-35606

Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...

CVE-2020-35606

CVE-2020-35606 affects Webmin 1.962 and earlier. An authenticated user in the Package Updates module can trigger arbitrary commands with root privileges via vectors involving %0A and %0C, due to an incomplete fix for CVE-2019-12840. Public references describe this as a remote command execution vu...

Low: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4.31 packages update

Red Hat OpenShift Container Platform release 4.4.31 is now available with updates to packages and images that fix several bugs. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This...

Fedora 33 : kernel / kernel-headers / kernel-tools (2020-98ccae320c)

The 5.9.8 stable kernel rebase contains a number of enhancements including new hardware support, additional features, and a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

Ubuntu: Security Advisory (USN-4617-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Low: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.5.15 packages update

Red Hat OpenShift Container Platform release 4.5.15 is now available with updates to packages and images that fix several bugs. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This...

OPENSUSE-SU-2020:1587-1 Security update for go1.14

This update for go1.14 fixes the following issues: - go1.14.9 released 2020-09-09 includes fixes to the compiler, linker, runtime, documentation, and the net/http and testing packages. Refs bsc1164903 go1.14 release tracking go41192 net/http/fcgi: race detected during execution of...

personnummer/ruby vulnerable to Improper Input Validation

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severity. Impact This vulnerability impacts...

MGASA-2020-0363 Updated ansible package fixes security vulnerabilities

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...