CVE-2020-14312

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not...

UBUNTU-CVE-2020-14312

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not...

Vulnerabilities fixed in X11 server

Vulnerabilities have been fixed in X11 server. The vulnerabilities potentially allow a malicious party to access system data and to gain elevated privileges gain. -= Oracle =- Oracle has made updates available for Oracle Linux 7. You can install these updates using the command 'yum'. More...

CVE-2020-10772

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared t...

fwupd: Possible bypass in signature verification

A PGP signature bypass flaw was found in fwupd, which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service LVFS is either not implemented or enabled in versions of fwupd...

Vulnerability fixed in Red Hat JBoss

Vulnerabilities have been fixed in JBoss. The vulnerabilities allow a malicious person to perform attacks that result in the following categories of damage: Denial-of-Service DoS. Circumvention of security measure Accessing system data Red Hat categorizes these vulnerabilities as "moderate. -= Re...

Vulnerabilities fixed in Red Hat OpenShift

Vulnerabilities have been fixed in Red Hat OpenShift. The vulnerabilities allow a malicious party to carry out attacks that lead to the following categories of damage: Denial-of-Service DoS Circumvention of security measure Accessing sensitive data Accessing system data -= Red Hat =- Red Hat has...

Security Bulletin: Vulnerability in Docker affects Cloud Pak Sytem (CVE-2020-13401)

Summary Vulnerability identified within Docker shipped as pType component with Cloud Pak System Software. IBM Cloud Pak System Software addressed this vulnerability. Vulnerability Details CVEID: CVE-2020-13401 DESCRIPTION: Docker Docker CE is vulnerable to a man-in-the-middle attack, caused by...

Vulnerability fixed in SPICE

A vulnerability has been fixed in SPICE. A malicious party could vulnerability potentially exploit it to cause a denial-of-service cause or execute arbitrary code. -= Debian =- Debian has made updates of spice available for Debian 10.0 Buster to fix the vulnerability. You can install the custom...

Vulnerabilities fixed in Red Hat ipa

Vulnerabilities have been fixed in Red Hat ipa. The vulnerabilities allow an unauthenticated malicious person to execute arbitrary code on the victim's browser. To do this, the malicious party must trick the victim into following a rogue hyper-link to follow. In addition, the vulnerabilities enab...

Vulnerability fixed in Red Hat OpenShift Container Platform

Red Hat has fixed a vulnerability in the OpenShift Container Platform. A local user or application with elevated privileges can write a large amount of data within a pod to the /etc/hosts file. A malicious party could potentially exploit this vulnerability to cause a denial-of-service on the node...

The vulnerability of the crypto_authenc_extractkeys file in the operating system kernel of Red Hat Enterprise Linux allows a hacker to trigger a service failure.

The vulnerability of the cryptoauthencextractkeys file crypto/authenc.c in the Red Hat Enterprise Linux kernel is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

grub2: grub_malloc does not validate allocation size allowing for arithmetic overflow and subsequent heap-based buffer overflow

A flaw was found in current grub2 versions as shipped with Red Hat Enterprise Linux 7 and 8, where the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This issue leads the function to return invalid memory allocations, causing heap-based...

grub2: grub_malloc does not validate allocation size allowing for arithmetic overflow and subsequent heap-based buffer overflow

A flaw was found in current grub2 versions as shipped with Red Hat Enterprise Linux 7 and 8, where the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This issue leads the function to return invalid memory allocations, causing heap-based...

grub2: grub_malloc does not validate allocation size allowing for arithmetic overflow and subsequent heap-based buffer overflow

A flaw was found in current grub2 versions as shipped with Red Hat Enterprise Linux 7 and 8, where the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This issue leads the function to return invalid memory allocations, causing heap-based...

grub2: grub_malloc does not validate allocation size allowing for arithmetic overflow and subsequent heap-based buffer overflow

A flaw was found in current grub2 versions as shipped with Red Hat Enterprise Linux 7 and 8, where the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This issue leads the function to return invalid memory allocations, causing heap-based...

UBUNTU-CVE-2020-10759

A PGP signature bypass flaw was found in fwupd all versions, which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service LVFS is either not implemented or enabled in versions ...

Security Bulletin: Vulnerability in curl affects IBM Cloud Pak System (CVE-2018-14618)

Summary Vulnerability is identified in curl used in Cloud Pak System. Cloud Pak System has addressed the vulnerability. Vulnerability Details CVEID: CVE-2018-14618 DESCRIPTION: curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect OS Images for Red Hat Linux Systems (Oct2019 updates)

Summary Multiple vulnerabilities in IBM® SDK Java™ Technology Edition v7 used by the OS Images for IBM Cloud Pak System. These issues were disclosed as part of the IBM Java SDK quarterly updates in October 2019. OS Images addressed applicable CVEs. Vulnerability Details CVEID: CVE-2019-2989...

Security Bulletin: IBM Integration Bus Hyper visor Edition V9.0 require customer action for security vulnerabilities in Red Hat Linux

Summary IBM Integration Bus Hypervisor Edition V9.0 ship with Red Hat Enterprise Linux RHEL Server 6.2 which is vulnerable to: CVE-2019-17547, CVE-2019-17541, CVE-2019-17540 Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes section Affected Products and Versio...