SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3263-1)

This update for the Linux Kernel 4.4.121-92120 fixes several issues. The following security issues were fixed : CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship bsc115632...

HPESBHF03974 rev.1 - HPE Servers using certain Intel Processors, Local Denial of Service, Disclosure of Information, Escalation of Privilege

Potential Security Impact: Local: Denial of Service DoS, Disclosure of Information, Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL20 Gen10 Server - Prior to v2.10 HPE ProLiant ML30 Gen10 Server - Prior to v2.10 HPE ProLiant m710x Server Bla...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3228-1)

This update for the Linux Kernel 4.4.180-94100 fixes several issues. The following security issues were fixed : CVE-2018-20856: Fixed a use-after-free in blkdrainqueue due to an improper error handling bsc1156331. CVE-2019-13272: Fixed a privilege escalation from user to root due to improper...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3261-1)

This update for the Linux Kernel 4.4.121-92114 fixes several issues. The following security issues were fixed : CVE-2018-20856: Fixed a use-after-free in blkdrainqueue due to an improper error handling bsc1156331. CVE-2019-13272: Fixed a privilege escalation from user to root due to improper...

USN-4214-2: RabbitMQ vulnerability

USN-4214-1 fixed a vulnerability in RabbitMQ. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that RabbitMQ incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary cod...

SUSE-SU-2019:3260-1 Security update for the Linux Kernel (Live Patch 29 for SLE 12 SP2)

This update for the Linux Kernel 4.4.121-92109 fixes several issues. The following security issues were fixed: - CVE-2018-20856: Fixed a use-after-free in blkdrainqueue due to an improper error handling bsc1156331. - CVE-2019-13272: Fixed a privilege escalation from user to root due to improper...

SUSE-SU-2019:3255-1 Security update for the Linux Kernel (Live Patch 8 for SLE 12 SP4)

This update for the Linux Kernel 4.12.14-9532 fixes several issues. The following security issue was fixed: - CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists bsc1153108. The following bugs were fixed: - Fixed boot up hang revealed by int3 se...

Authentication flaw

Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers disclos...

CVE-2019-17270

Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers disclos...

SUSE-SU-2019:3233-1 Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP1)

This update for the Linux Kernel 3.12.74-6064121 fixes several issues. The following security issues were fixed: - CVE-2019-15917: Fixed a use-after-free issue when hciuartregisterdev fails in hciuartsetproto in drivers/bluetooth/hcildisc.c bsc1156334. - CVE-2019-10220: Fixed Samba servers that c...

SUSE-SU-2019:3216-1 Security update for the Linux Kernel (Live Patch 6 for SLE 15 SP1)

This update for the Linux Kernel 4.12.14-19721 fixes several issues. The following security issue was fixed: - CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists bsc1153108. The following bugs were fixed: - Fixed boot up hang revealed by int3...

CVE-2018-1002102 Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificat...

USN-4214-1: RabbitMQ vulnerability

It was discovered that RabbitMQ incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code...

EulerOS 2.0 SP2 : libXrender (EulerOS-SA-2019-2458)

According to the versions of the libXrender packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple buffer overflows in the 1 XvQueryAdaptors and 2 XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers...

EulerOS 2.0 SP2 : libXvMC (EulerOS-SA-2019-2441)

According to the version of the libXvMC package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string.CVE-2016-7953 Note that...

EulerOS 2.0 SP2 : libXi (EulerOS-SA-2019-2434)

According to the versions of the libXi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple integer overflows in X.org libXi before 1.7.7 allow remote X servers to cause a denial of service out-of-bounds memory access or infinit...

EulerOS 2.0 SP2 : openssh (EulerOS-SA-2019-2483)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filenam...

GHSA-4X6V-RWH4-55JW Pomelo allows external control of critical state data

Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious...

[SECURITY] Fedora 30 Update: clamav-0.101.5-1.fc30

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

[SECURITY] Fedora 30 Update: freeradius-3.0.20-1.fc30

The FreeRADIUS Server Project is a high performance and highly configurable GPL'd free RADIUS server. The server is similar in some respects to Livingston's 2.0 server. While FreeRADIUS started as a variant of the Cistron RADIUS server, they don't share a lot in common any more. It now has many...