Ubuntu 20.10 : python-apt regression (USN-4668-2)

The remote Ubuntu 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4668-2 advisory. USN-4668-1 introduced a regression in python-apt. Tenable has extracted the preceding description block directly from the Ubuntu security advisory. Note that Nessus h...

DLA-2340-2 sqlite3 - regression update

Bulletin has no description...

SUSE SLES15 Security Update : Salt (SUSE-SU-2020:3244-1)

This update fixes the following issues : salt : Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string bsc1178485 Properly validate eauth credentials and tokens on SSH calls made by Salt API bsc1178319, bsc1178362, bsc1178361, CVE-2020-25592, CVE-2020-17490,...

SUSE SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2020:3460-1)

This update for java-180-openjdk fixes the following issues : Fix regression '8250861: Crash in MinINode::IdealPhaseGVN, bool', introduced in October 2020 CPU. Update to version jdk8u272 icedtea 3.17.0 July 2020 CPU, bsc1174157, and October 2020 CPU, bsc1177943 - New features + JDK-8245468: Add...

SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2020:3243-1)

This update for salt fixes the following issues : Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string bsc1178485 Properly validate eauth credentials and tokens on SSH calls made by Salt API bsc1178319, bsc1178362, bsc1178361, CVE-2020-25592, CVE-2020-17490,...

Debian DLA-2480-2 : salt regression update

Past security updates of Salt, a remote execution manager, introduced regressions for which follow-up fixes were published : CVE 2020-16846 regression 'salt-ssh' master key initialization fails CVE 2021-3197 regression Valid parameters are discarded for the SSHClient CVE 2020-28243 follow-up...

serenity:FuzzPNGLoader: Heap-buffer-overflow in decode

Detailed Report: https://oss-fuzz.com/testcase?key=6265409137016832 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzPNGLoader Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x604000000100 Crash State: decode codes fixed...

serenity:FuzzRegexPosixExtended: Heap-buffer-overflow in regex::Lexer::back

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5077400093982720 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzRegexPosixExtended Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

llvm:llvm-dwarfdump-fuzzer: Heap-buffer-overflow in llvm::StringMapImpl::LookupBucketFor

Detailed Report: https://oss-fuzz.com/testcase?key=5071836601384960 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-dwarfdump-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x607000000148 Crash State:...

CVE-2020-15257

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting...

Debian DLA-2467-2 : lxml regression update

The fix for CVE-2020-27783, released as DLA 2467-1, was incomplete as the component was still affected by the vulnerability. This update includes an additional patch that completes the fix. Note that a package with version 3.7.1-1+deb9u2 was uploaded, but before the publication of the advisory a...

openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2020-2083)

This update for java-180-openjdk fixes the following issues : - Fix regression '8250861: Crash in MinINode::IdealPhaseGVN, bool', introduced in October 2020 CPU. - Update to version jdk8u272 icedtea 3.17.0 July 2020 CPU, bsc1174157, and October 2020 CPU, bsc1177943 - New features + JDK-8245468: A...

USN-4646-2 poppler regression

USN-4646-1 fixed vulnerabilities in poppler. The fix for CVE-2019-10871 introduced a regression causing certain applications linked against poppler to fail. This update backs out the fix pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovere...

USN-4646-2: poppler regression

USN-4646-1 fixed vulnerabilities in poppler. The fix for CVE-2019-10871 introduced a regression causing certain applications linked against poppler to fail. This update backs out the fix pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovere...

OPENSUSE-SU-2020:2048-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: - Fix regression '8250861: Crash in MinINode::IdealPhaseGVN, bool', introduced in October 2020 CPU. - Update to version jdk8u272 icedtea 3.17.0 July 2020 CPU, bsc1174157, and October 2020 CPU, bsc1177943 New features + JDK-8245468: Add...

Ubuntu 16.04 LTS / 18.04 LTS : poppler regression (USN-4646-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4646-2 advisory. USN-4646-1 fixed vulnerabilities in poppler. The fix for CVE-2019-10871 introduced a regression causing certain applications linked against poppler to...

[SECURITY] [DLA 2379-3] mediawiki regression update

Debian LTS Advisory DLA-2379-3 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez November 21, 2020 https://wiki.debian.org/LTS Package : mediawiki Version : 1:1.27.7-1deb9u6 The update of mediawiki released as DLA-2379-2 contained a defect in the patch for...

SUSE-SU-2020:3424-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: wpasupplicant was updated to 2.9 release: SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks https://w1.fi/security/2019-6/ EAP-pwd changes - disable use of groups using Brainpool...

llvm:clang-objc-fuzzer: Use-of-uninitialized-value in clang::Lexer::getTokenPrefixLength

Detailed Report: https://oss-fuzz.com/testcase?key=5735061403729920 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-objc-fuzzer Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: clang::Lexer::getTokenPrefixLength Diag...

[SECURITY] [DLA 2447-2] pacemaker regression update

Debian LTS Advisory DLA-2447-2 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 17, 2020 https://wiki.debian.org/LTS Package : pacemaker Version : 1.1.16-1+deb9u2 Debian Bug : 974563 The update of pacemaker released as DLA-2447-1 caused a regression when t...