CentOS 8 : pcs (CESA-2021:4142)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4142 advisory. - jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2020-11023 - jquery: Cross-site scripting XSS via HTML tags...

CentOS 8 : mutt (CESA-2021:4181)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4181 advisory. - mutt: Incorrect handling of invalid initial IMAP responses could lead to an authentication attempt over unencrypted connection CVE-2020-28896 - mutt:...

RHEL 8 : babel (RHSA-2021:4201)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4201 advisory. Babel provides tools to build and work with gettext message catalogs, and a Python interface to the CLDR Common Locale Data Repository,...

CentOS 8 : container-tools:rhel8 (CESA-2021:4154)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4154 advisory. - containers/storage: DoS via malicious image CVE-2021-20291 - buildah: Host environment variables leaked in build container when using chroot isolatio...

CentOS 8 : autotrace (CESA-2021:4519)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4519 advisory. - autotrace: integer overflow in input-bmp.c CVE-2019-19004 - autotrace: bitmap double free in main.c allows attackers to cause an unspecified impact...

CentOS 8 : edk2 (CESA-2021:4198)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4198 advisory. - openssl: integer overflow in CipherUpdate CVE-2021-23840 - openssl: NULL pointer dereference in X509issuerandserialhash CVE-2021-23841 Note that Ness...

CentOS 8 : pcre (CESA-2021:4373)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4373 advisory. - pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 CVE-2019-20838 - pcre: Integer overflow when...

CentOS 8 : glib2 (CESA-2021:4385)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4385 advisory. - glib: gfilereplace with GFILECREATEREPLACEDESTINATION creates empty target for dangling symlink CVE-2021-28153 - glib2: Possible privilege escalation...

CentOS 8 : openssl (CESA-2021:4424)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4424 advisory. - openssl: integer overflow in CipherUpdate CVE-2021-23840 - openssl: NULL pointer dereference in X509issuerandserialhash CVE-2021-23841 Note that Ness...

RHEL 8 : pcre (RHSA-2021:4373)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4373 advisory. PCRE is a Perl-compatible regular expression library. Security Fixes: pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has...

RHEL 8 : ncurses (RHSA-2021:4426)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4426 advisory. The ncurses new curses library routines are a terminal-independent method of updating character screens with reasonable optimization. The...

Microsoft’s Patch Tuesday Security Updates for November

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. For the month of November, Microsoft has reported a total of 55 vulnerabilities, 6CVE-2021-38666, CVE-2021-26443, CVE-2021-42279, CVE-2021-42298, CVE-2021-42316, CVE-2021-3711 of which have been rated critical. Four...

13 New Flaws in Siemens Nucleus TCP/IP Stack Impact Safety-Critical Equipment

As many as 13 security vulnerabilities have been discovered in the Nucleus TCP/IP stack, a software library now maintained by Siemens and used in three billion operational technology and IoT devices that could allow for remote code execution, denial-of-service DoS, and information leak...

Microsoft Issues Patches for Actively Exploited Excel, Exchange Server 0-Day Bugs

Microsoft has released security updates as part of its monthly Patch Tuesday release cycle to address 55 vulnerabilities across Windows, Azure, Visual Studio, Windows Hyper-V, and Office, including fixes for two actively exploited zero-day flaws in Excel and Exchange Server that could be abused t...

Vulnerabilities fixed in Adobe products

Vulnerabilities have been fixed in several Adobe products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Remote code execution User Rights Adobe has released updates to fix the...

CVE-2021-42321

Microsoft Exchange Server Remote Code Execution Vulnerability Recent assessments: gwillcox-r7 at November 21, 2021 5:55pm UTC reported: A PoC for this vulnerability is now available at https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398. There is also a Metasploit module at...

Microsoft Patch Tuesday, November 2021 Edition

Microsoft Corp. today released updates to quash at least 55 security bugs in its Windows operating systems and other software. Two of the patches address vulnerabilities that are already being used in active attacks online, and four of the flaws were disclosed publicly before today -- potentially...

sil-nuosu-fonts bug fix and enhancement update

An update is available for sil-nuosu-fonts. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Citrix Releases Security Updates

Citrix has released security updates to address vulnerabilities affecting multiple versions of Citrix Application Delivery Controller ADC, Gateway, and SD-WAN WANOP. An attacker could exploit these vulnerabilities to cause a denial-of-service condition. CISA encourages users and administrators to...

Adobe Releases Security Updates for Multiple Products

Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Adobe Security Bulletins and apply the necessa...