EulerOS Virtualization 3.0.6.6 : python-pillow (EulerOS-SA-2020-2473)

According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.CVE-2020-10177 - In libImaging/PcxDecode.c i...

Out Of Bound Reads (OOB)

kernel-rt is vulnerable to out-of-bound OOB reads. The vulnerability exists in the vcdoresize function in drivers/tty/vt/vt.c allowing an attacker to perform a UAF read...

Huawei EulerOS: Security Advisory for libexif (EulerOS-SA-2020-2356)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4615-1: Yerase's TNEF vulnerabilities

It was discovered that Yerase's TNEF had null pointer dereferences, infinite loop, buffer overflow, out of bounds reads, directory traversal issues and other vulnerabilities. An attacker could use those issues to cause a crash and consequently a denial of service. CVE-2017-6298, CVE-2017-6299,...

Debian DLA-2421-1 : cimg security update

Several issues have been found in cimg, a powerful image processing library. CVE-2019-1010174 is related to a missing string sanitization on URLs, which might result in a command injection when loading a special crafted image. The other CVEs are about heap-based buffer over-reads or double frees...

Debian: Security Advisory (DLA-2421-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : python-pillow (EulerOS-SA-2020-2266)

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.CVE-2020-10177 - In libImaging/PcxDecode.c in Pillow before...

Huawei EulerOS: Security Advisory for python-pillow (EulerOS-SA-2020-2266)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2 : SDL (ALAS-2020-1500)

The version of SDL installed on the remote host is prior to 1.2.15-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1500 advisory. SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMAADPCMnibble in audio/SDLwave....

golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs

A flaw was found in the Go encoding/binary package. Certain invalid inputs to the ReadUvarint or the ReadVarint causes those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This flaw possibly leads to processing more input than expected. The...

OpenJDK: Missing permission check in path to URI conversion (Libraries, 8242680)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multipl...

OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136)

Vulnerability in the Java SE product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of th...

Oracle PeopleSoft Enterprise PeopleTools Authorization Issues Vulnerability

Oracle PeopleSoft Enterprise PeopleTools is a component of Oracle's tools and technology platform that supports the transformation of the way organizations manage, use, and maintain their PeopleSoft software. A security vulnerability in Oracle PeopleSoft Enterprise PeopleTools PIA Grids version...

IBM Oracle REST Data Services Unauthorized Access Vulnerability

IBM Oracle REST Data Services ORDS is a JAVA Web middleware application from IBM. The middleware maps REST interfaces such as Http/Https to database transactions. An unauthorized access vulnerability exists in Oracle REST Data Services, which can be exploited by an attacker to compromise Oracle...

CVE-2020-14778

Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM...

EulerOS Virtualization for ARM 64 3.0.6.0 : python-pillow (EulerOS-SA-2020-2024)

According to the versions of the python-pillow package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.CVE-2020-5311 - In...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2020-54655)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in tensorflow-lite versions prior to 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, and 2.3.1, which can be exploited by an attacker to write and read from outside the...

EulerOS 2.0 SP3 : libexif (EulerOS-SA-2020-2142)

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - exifentrygetvalue in exif-entry.c in libexif 0.6.21 has a divide-by-zero error.CVE-2020-12767 - An issue was discovered in libexif before 0.6.22...

PYSEC-2020-119

In Tensorflow version 2.3.0, the SparseCountSparseOutput and RaggedCountSparseOutput implementations don't validate that the weights tensor has the same shape as the data. The check exists for DenseCountSparseOutput, where both tensors are fully specified. In the sparse and ragged count weights a...

PYSEC-2020-131

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can...