e2fsprogs security, bug fix, and enhancement update

1.45.4-3 - Fix clang warning introduced in previous release 1783777 1.45.4-2 - Fix ABI breakage introduced in previous release 1783777 1.45.4-1 - Rebase to the release 1.45.4 1783777 - provide rhel6/7 compatible fstype in mke2fs.conf 1780279 - fix crafted ext4 partition leads to out-of-bounds wri...

Linux: Assign an independent partition to application data

Dedicated application data must have an independent partition. If partitions are improperly set, junk data or logs may fill the entire hard disk, causing the crash of the entire system. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources,...

e2fsprogs: Out-of-bounds write in e2fsck/rehash.c

A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability...

wxHexEditor - Hex Editor / Disk Editor for Huge Files or Devices on Linux, Windows and MacOSX

wxHexEditor is another Free Hex Editor, build because there is no good hex editor for Linux system, specially for big files. Low Level Data Recovery with wxHexEditor wxHexEditor is not an ordinary hex editor, but could work as low level disk editor too. If you have problems with your HDD or...

EulerOS 2.0 SP3 : e2fsprogs (EulerOS-SA-2020-1379)

According to the version of the e2fsprogs packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory ca...

Denial Of Service (DoS)

spacewalk-backend is vulnerable to denial of service. It was found that a remote attacker could upload packages to an RHN Satellite server's NULL organization without any authorization or authentication. The NULL organization stores packages synced from RHN Hosted. Although an attacker cannot put...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists through a heap overflow flaw in the EFI GUID Partition Table GPT implementation could allow a local attacker to cause a denial of service by mounting a disk containing specially-crafted partition tables...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists as a heap overflow flaw in the Linux kernel's EFI GUID Partition Table GPT implementation could allow a local attacker to cause a denial of service by mounting a disk that contains specially-crafted partition tables...

Information Disclosure

kernel is vulnerable to information disclosure. The vulnerability exists as a buffer overflow flaw in the DEC Alpha OSF partition implementation in the Linux kernel could allow a local attacker to cause an information leak by mounting a disk that contains specially-crafted partition tables...

Unveiled: How xHelper Android Malware Re-Installs Even After Factory Reset

Remember xHelper? A mysterious piece of Android malware that re-installs itself on infected devices even after users delete it or factory reset their devices—making it nearly impossible to remove. xHelper reportedly infected over 45,000 devices last year, and since then, cybersecurity researchers...

Unkillable xHelper and a Trojan matryoshka

It was the middle of last year that we detected the start of mass attacks by the xHelper Trojan on Android smartphones, but even now the malware remains as active as ever. The main feature of xHelper is entrenchment — once it gets into the phone, it somehow remains there even after the user delet...

EulerOS Virtualization for ARM 64 3.0.6.0 : e2fsprogs (EulerOS-SA-2020-1347)

According to the versions of the e2fsprogs packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially...

Authorization

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all...

Debian: Security Advisory (DLA-2156-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-20578

An issue was discovered on Samsung mobile devices with P9.0 Exynos 9820 chipsets software. A Buffer overflow occurs when loading the UH Partition during Secure Boot. The Samsung ID is SVE-2019-14412 August 2019...

CVE-2019-20578

An issue was discovered on Samsung mobile devices with P9.0 Exynos 9820 chipsets software. A Buffer overflow occurs when loading the UH Partition during Secure Boot. The Samsung ID is SVE-2019-14412 August 2019...

PT-2020-10555

Name of the Vulnerable Software and Affected Versions Samsung mobile devices with P9.0 Exynos 9820 chipsets software Description A buffer overflow issue occurs when loading the UH Partition during Secure Boot, potentially affecting Samsung mobile devices. Recommendations For Samsung mobile device...

CVE-2019-20578: Buffer Copy without Checking Size of Input

An issue was discovered on Samsung mobile devices with P9.0 Exynos 9820 chipsets software. A Buffer overflow occurs when loading the UH Partition during Secure Boot. The Samsung ID is SVE-2019-14412 August 2019...

CVE-2019-17102

An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/updatesetup does not perform firmware signature checks atomically, leading to an exploitable race condition TOCTTOU that allows arbitrary execution of system...

CVE-2019-17102 Bitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)

An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/updatesetup does not perform firmware signature checks atomically, leading to an exploitable race condition TOCTTOU that allows arbitrary execution of system...