Advantech Spectre RT Industrial Routers

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: Spectre RT Industrial Routers Vulnerabilities: Improper Neutralization of Input During Web Page Generation, Cleartext Transmission of Sensitive Information, Improper...

CentOS 8 : kernel (CESA-2020:1372)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1372 advisory. - kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception CVE-2019-15030 - kernel: powerpc...

CentOS 8 : kernel (CESA-2019:2411)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2411 advisory. - kernel: hw: Spectre SWAPGS gadget vulnerability CVE-2019-1125 - kernel: broken permission and object lifetime handling for PTRACETRACEME CVE-2019-132...

CentOS 8 : firefox (CESA-2019:0966)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:0966 advisory. - Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied CVE-2018-18506 - Mozilla: Memory safety bugs fixed in Firefox 66 and...

SUSE SLED15 / SLES15 Security Update : go1.15 (SUSE-SU-2020:2776-1)

go1.15 released 2020-08-11 Go 1.15 is a major release of Go. go1.15.x minor releases will be provided through August 2021. https://github.com/golang/go/wiki/Go-Release-Cycle Most changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1...

Microsoft hopes Windows PCs protection with Pluton security chip

By Deeba Ahmed The new Pluton security processor will amplify chip security and prevent hardware flaws like Spectre and Meltdown to steal data from processors. This is a post from HackRead.com Read the original post: Microsoft hopes Windows PCs protection with Pluton security chip...

Security Bulletin: IBM Security QRadar Packet Capture has released 7.3.1 Patch 1, and 7.2.8 Patch 4 in response to the vulnerabilities known as Spectre and Meltdown.

Summary IBM has released the following 7.3.1 Patch 1, and 7.2.8 Patch 4 for IBM QRadar Packet Capture in response to CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754. Vulnerability Details CVEID: CVE-2017-5753 CVEID: CVE-2017-5715 CVEID: CVE-2017-5754 Affected Products and Versions IBM QRadar Packe...

Exploit for Observable Discrepancy in Intel Atom_C

PoC exploit for CVE-2017-5753 and CVE-2017-5715, variants of the Spectre attack. The target product/service is the CPU, specifically the x86 architecture. The vulnerability class/vector is speculative execution, allowing an attacker to trick error-free programs into leaking their secrets. The...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5885)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5885 advisory. - ext4: fix potential negative array index in dosplit Eric Sandeen Orabug: 31895330 CVE-2020-14314 - mm/hugetlb: fix a race between hugetlb sysctl...

A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality.

...

A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.

...

CVE-2020-10768

A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threa...

DEBIAN-CVE-2020-10768

A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threa...

CVE-2020-10768

A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threa...

Design/Logic Flaw

A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threa...

CVE-2020-10767

A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB Indirect Branch Prediction Barrier. The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation IBRS is available. This flaw allows a loc...

CVE-2020-10767

A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB Indirect Branch Prediction Barrier. The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation IBRS is available. This flaw allows a loc...

DEBIAN-CVE-2020-10767

A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB Indirect Branch Prediction Barrier. The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation IBRS is available. This flaw allows a loc...

Design/Logic Flaw

A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB Indirect Branch Prediction Barrier. The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation IBRS is available. This flaw allows a loc...

CVE-2020-10768

CVE-2020-10768 affects the Linux kernel prior to 5.8-rc1, where prctl() can re-enable indirect branch speculation after it has been disabled, enabling Spectre v2-style disclosure. The vulnerability has Local attack vector and primarily impacts confidentiality; no exploitation details are provided...