CVE-2020-25580

CVE-2020-25580 describes a regression in the FreeBSD login.access(5) rule processor across multiple FreeBSD releases (12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4, 11.4-RELEASE before p8). The regression causes login.access rules to fail to match when they should...

CVE-2020-25580

In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the login.access5 rule processor has the effect of causing rules to fail to match even when they should not. This means that rules denying access may be ignored...

USN-3685-2 ruby2.0 regression

USN-3685-1 fixed a vulnerability in Ruby. The fix for CVE-2017-0903 introduced a regression in Ruby. This update fixes the problem. Original advisory details: Some of these CVE were already addressed in previous USN: 3439-1, 3553-1, 3528-1. Here we address for the remain releases. It was discover...

USN-3685-2: Ruby regression

USN-3685-1 fixed a vulnerability in Ruby. The fix for CVE-2017-0903 introduced a regression in Ruby. This update fixes the problem. Original advisory details: Some of these CVE were already addressed in previous USN: 3439-1, 3553-1, 3528-1. Here we address for the remain releases. It was discover...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Dnsmasq regression (USN-4698-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4698-2 advisory. USN-4698-1 fixed vulnerabilities in Dnsmasq. The updates introduced regressions in certain environments related to issues with multiple...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU regression (USN-4467-3)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4467-3 advisory. USN-4467-1 fixed vulnerabilities in QEMU. The fix for CVE-2020-13754 introduced a regression in certain environments. This update fixes th...

Ubuntu 16.04 LTS / 18.04 LTS : Python regression (USN-4754-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4754-2 advisory. USN-4754-1 fixed a vulnerability in Python. The fix for CVE-2021-3177 introduced a regression in Python 2.7. This update reverts the security fix...

[SECURITY] [DLA 2558-2] xterm regression update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2558-2 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 21, 2021 https://wiki.debian.org/LTS -...

DLA-2558-2 xterm - regression update

Bulletin has no description...

undertow: Possible regression in fix for CVE-2020-10687

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

undertow: Possible regression in fix for CVE-2020-10687

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

undertow: Possible regression in fix for CVE-2020-10687

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

[SECURITY] [DLA 2589-2] mupdf regression update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2589-2 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 14, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2589-2 : mupdf regression update

DLA 2589-1 incorrectly fixed CVE-2020-26519 and also induced regression where opening a PDF document resulted in a SIGFPE crash, a floating point exception. For Debian 9 stretch, this problem has been fixed in version 1.9a+ds1-4+deb9u7. We recommend that you upgrade your mupdf packages. For the...

CVE-2021-21378 JWT authentication bypass with unknown issuer token

Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the allowmissing requirement under...

Ubuntu: Security Advisory (USN-4733-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4733-2: GNOME Autoar regression

USN-4733-1 fixed a vulnerability in GNOME Autoar. The upstream fix introduced a regression when extracting archives containing directories. This update fixes the problem. Original advisory details: Yiğit Can Yılmaz discovered that GNOME Autoar could extract files outside of the intended directory...

USN-4733-2 gnome-autoar regression

USN-4733-1 fixed a vulnerability in GNOME Autoar. The upstream fix introduced a regression when extracting archives containing directories. This update fixes the problem. Original advisory details: Yiğit Can Yılmaz discovered that GNOME Autoar could extract files outside of the intended directory...

DLA-2553-2 xcftools - regression update

Bulletin has no description...

CVE-2020-28601

A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef2/PMioparser.h PMioparser::readvertex Faceof OOB read. An attacker can provide malicious input to trigger this vulnerability...