SUSE SLES15 Security Update : spice (SUSE-SU-2021:1956-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1956-1 advisory. - CVE-2021-20201: client initiated renegotiation causing denial of service bsc1181686 - CVE-2020-14355: Fixed multiple buffer...

SUSE SLES15: libspice-client-glib-2_0-8 / libspice-client-glib-helper / etc (SUSE-SU-2021:1928-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:1928-1 advisory. - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code bsc1177158 Tenable has extracted the preceding...

SUSE-SU-2021:1956-1 Security update for spice

This update for spice fixes the following issues: - CVE-2021-20201: client initiated renegotiation causing denial of service bsc1181686 - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code bsc1177158...

SUSE-SU-2021:1928-1 Security update for spice-gtk

This update for spice-gtk fixes the following issues: - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code bsc1177158...

SUSE SLES15: libspice-client-glib-2_0-8 / libspice-client-glib-helper / etc (SUSE-SU-2021:1911-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:1911-1 advisory. - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code bsc1177158 Tenable has extracted the preceding...

SUSE-SU-2021:1911-1 Security update for spice-gtk

This update for spice-gtk fixes the following issues: - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code bsc1177158...

SUSE: Security Advisory (SUSE-SU-2020:3070-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15 Security Update : spice (SUSE-SU-2021:1901-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1901-1 advisory. - CVE-2021-20201: client initiated renegotiation causing denial of service bsc1181686 - CVE-2020-14355: Fixed multiple buffer...

SUSE SLES12 Security Update : spice (SUSE-SU-2021:1902-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1902-1 advisory. - CVE-2021-20201: client initiated renegotiation causing denial of service bsc1181686 - CVE-2020-14355: Fixed multiple buffer...

SUSE-SU-2021:1905-1 Security update for spice-gtk

This update for spice-gtk fixes the following issues: - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code bsc1177158...

SUSE-SU-2021:1902-1 Security update for spice

This update for spice fixes the following issues: - CVE-2021-20201: client initiated renegotiation causing denial of service bsc1181686 - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code bsc1177158...

SUSE-SU-2021:1901-1 Security update for spice

This update for spice fixes the following issues: - CVE-2021-20201: client initiated renegotiation causing denial of service bsc1181686 - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code bsc1177158...

spice security update

0.14.3-4 - Disable client-side renegotiation to prevent potential DoS Resolves: rhbz1904459 0.14.3-3 - Fix some static analyzer issues - Removed Obsoletes line for spice-client Related: rhbz1840240 0.14.3-2 - Fix multiple buffer overflows in QUIC decoding code Resolves: rhbz1829946 0.14.3-1 -...

quic-go:token_fuzzer: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=6558985382658048 Project: quic-go Fuzzing Engine: libFuzzer Fuzz Target: tokenfuzzer Job Type: libfuzzerasanquic-go Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreate...

quic-go:frame_fuzzer: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=6522251143938048 Project: quic-go Fuzzing Engine: libFuzzer Fuzz Target: framefuzzer Job Type: libfuzzerasanquic-go Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreate...

CVE-2021-24029

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit...

Session fixation

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit...

CVE-2021-24029

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit...

CVE-2021-24029

Summary of CVE-2021-24029 (mvfst/proxygen) : A specially crafted QUIC message can trigger a crash via a failed assertion in mvfst, treated as a connection error per QUIC spec. The issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to ...

CVE-2021-24029

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit...