[SECURITY] [DSA 4752-1] bind9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4752-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 27, 2020 https://www.debian.org/security/faq -...

ISC BIND Zone Update Vulnerability (cve-2020-8624)

ISC BIND versions 9.9.12 to 9.9.13, 9.10.7 to 9.10.8, 9.11.3 to 9.11.21, 9.12.1 to 9.16.5, 9.17.0 to 9.17.3 as well as 9.9.12-S1 to 9.9.13-S1, 9.11.3-S1 to 9.11.21-S1 of the BIND 9 Supported Preview Edition are affected by a vulnerability. An authenticated, remote attacker who has been granted...

Discount Rules for WooCommerce < 2.1.0 - Multiple Vulnerabilities

The Discount Rules for WooCommerce plugin versions below 2.1.0 suffers from multiple vulnerabilities such as SQL injection, authorization issues and unauthenticated stored cross-site scripting. The issues in this plugin are caused due to a lack of authorization and nonce token check. The plugin...

WordPress Discount Rules for WooCommerce plugin <= 2.0.2 - Multiple (XSS, SQLi) Vulnerabilities

Multiple XSS, SQLi Vulnerabilities found by WebARX Security in WordPress Discount Rules for WooCommerce plugin versions = 2.0.2. Solution Update the WordPress Discount Rules for WooCommerce plugin to the latest available version at least 2.1.0...

CVE-2020-14937

Memory access out of buffer boundaries issues was discovered in Contiki-NG 4.4 through 4.5, in the SNMP BER encoder/decoder. The length of provided input/output buffers is insufficiently verified during the encoding and decoding of data. This may lead to out-of-bounds buffer read or write access ...

Citrix Systems XenMobile Server Information Disclosure Vulnerability

Citrix Systems XenMobile Server is a mobility management solution from Citrix Systems. The solution is able to manage mobile devices, develop mobile policies and compliance rules, and gain insight into the operation of mobile mobile networks. An information disclosure vulnerability exists in Citr...

GHSA-VRV8-V4W8-F95H Cross-site scripting vulnerability in TinyMCE

Impact A cross-site scripting XSS vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower a...

IRFuzz - Simple Scanner with Yara Rule

IRFuzz is a simple scanner with yara rules for document archives or any files. Install 1. Prerequisites Linux or OS X Yara: just use the latest release source code, compile and install it or install it via pip install yara-python Yara Rules - You may download yara rules from here or import your...

DEBIAN-CVE-2020-11985

IP address spoofing when proxying using modremoteip and modrewrite For configurations using proxying with modremoteip and certain modrewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively...

UBUNTU-CVE-2020-11985

IP address spoofing when proxying using modremoteip and modrewrite For configurations using proxying with modremoteip and certain modrewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively...

The vulnerability of the Chromium browser’s user interface in Google Chrome, related to errors in the application of rules for extensions, allows a violator to compromise data integrity.

The vulnerability of Google Chrome’s Chromium user interface is related to errors in the application of rules in extensions. Exploiting this vulnerability allows a malicious actor to affect data integrity through a specially created HTML page...

Netgear Won't Patch 45 Router Models Vulnerable to Serious Flaw

UPDATE Netgear will not patch 45 router models that are vulnerable to a high-severity remote code execution flaw, the router company revealed last week. However, the company says that routers that won’t receive updates are outdated or have reached EOL End of Life. The remote code execution...

openSUSE Security Update : SUSE Manager Client Tools (openSUSE-2020-1105)

This update fixes the following issues : dracut-saltboot : - Print a list of available disk devices bsc1170824 - Install wipefs to initrd - Force install crypt modules golang-github-prometheus-prometheus : - Update change log and spec file + Modified spec file: default to golang 1.14 to avoid 'ha...

Mozilla: Add-On updates did not respect the same certificate trust rules as software updates

The Mozilla Foundation Security Advisory describes this flaw as: When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected even if they were legitimately added by an administrator. This could have caused add-ons to become out-of-date silently without...

Mozilla: Add-On updates did not respect the same certificate trust rules as software updates

The Mozilla Foundation Security Advisory describes this flaw as: When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected even if they were legitimately added by an administrator. This could have caused add-ons to become out-of-date silently without...

openSUSE Security Update : MozillaThunderbird (openSUSE-2020-982)

This update for MozillaThunderbird to version 68.10.0 ESR fixes the following issues : - CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 bsc1173576. - CVE-2020-12418: Information disclosure due to manipulated URL object bsc1173576. - CVE-2020-12419:...

Security Bulletin: OpenStack vulnerabilities affect IBM SmartCloud Entry(CVE-2015-5240 CVE-2015-3280)

Summary IBM SmartCloud Entry is vulnerable to a Nova vulnerability that allows a remote authenticated attacker to cause a denial of service. IBM SmartCloud Entry is vulnerable to a Neutron vulnerability that allows an attacker to bypass firewall rules and gain access to applications. Vulnerabilit...

OPENSUSE-SU-2020:0982-1 Security update for MozillaThunderbird

This update for MozillaThunderbird to version 68.10.0 ESR fixes the following issues: - CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 bsc1173576. - CVE-2020-12418: Information disclosure due to manipulated URL object bsc1173576. - CVE-2020-12419:...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20200716)

Security Fixes : - Mozilla: Information disclosure due to manipulated URL object CVE-2020-12418 - Mozilla: Use-after-free in nsGlobalWindowInner CVE-2020-12419 - Mozilla: Use-After-Free when trying to connect to a STUN server CVE-2020-12420 - Mozilla: Add-On updates did not respect the same...

Mozilla: Add-On updates did not respect the same certificate trust rules as software updates

The Mozilla Foundation Security Advisory describes this flaw as: When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected even if they were legitimately added by an administrator. This could have caused add-ons to become out-of-date silently without...