Security update for java-1_8_0-openj9 (important)

openSUSE Security Update: Security update for java-180-openj9 Announcement ID: openSUSE-SU-2020:0841-1 Rating: important References: 1169511 1171352 Cross-References: CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805...

SUSE-SU-2020:1685-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: java-180-ibm was updated to Java 8.0 Service Refresh 6 Fix Pack 10 bsc1172277,bsc1169511,bsc1160968 - CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service - CVE-2020-2754:...

SUSE-SU-2020:1684-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: java-180-ibm was updated to Java 8.0 Service Refresh 6 Fix Pack 10 bsc1172277,bsc1169511,bsc1160968 - CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service - CVE-2020-2754:...

SUSE-SU-2020:14398-1 Security update for java-1_7_1-ibm

This update for java-171-ibm fixes the following issues: java-171-ibm was updated to Java 7.1 Service Refresh 4 Fix Pack 65 bsc1172277 and bsc1169511 - CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service - CVE-2020-2756: Improved...

Security update for java-1_8_0-openjdk (important)

openSUSE Security Update: Security update for java-180-openjdk Announcement ID: openSUSE-SU-2020:0800-1 Rating: important References: 1160398 1169511 1171352 Cross-References: CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803...

SUSE-SU-2020:14391-1 Security update for java-1_7_0-ibm

This update for java-170-ibm fixes the following issues: java-171-ibm was updated to Java 7.1 Service Refresh 4 Fix Pack 65 bsc1172277 and bsc1169511 - CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service - CVE-2020-2756: Improved...

SUSE-SU-2020:1569-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk to version jdk8u252 fixes the following issues: - CVE-2020-2754: Forward references to Nashorn bsc1169511 - CVE-2020-2755: Improve Nashorn matching bsc1169511 - CVE-2020-2756: Better mapping of serial ENUMs bsc1169511 - CVE-2020-2757: Less Blocking Array Queues...

CVE-2020-8867: Time-of-check Time-of-use (TOCTOU) Race Condition

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results fr...

OPC Foundation UA .NET Standard Code Issue Vulnerability

NET Standard is the OPC Foundation's OPC Foundation set of unified architecture standards for developing OPC UA applications. A security vulnerability exists in the handling of sessions in OPC Foundation UA.NET Standard due to a lack of proper locking when performing operations on objects. An...

(Pwn2Own) OPC Foundation UA .NET Standard CreateSessionRequest Race Condition Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results from the lack ...

Information Disclosure

php is vulnerable to information disclosure. The vulnerability exists as a PHP script which used the transparent session ID configuration option, or which used the outputaddrewritevar function, could leak session identifiers to external web sites. If a page included an HTML form with an ACTION...

Improper Session Handling

php is vulnerable to improper session handling. The vulnerability exists as an attacker to create a cross-site cookie insertion attack if a victim follows an untrusted carefully-crafted URL...

httpd: mod_session_cookie does not respect expiry time

In Apache HTTP Server 2.4 release 2.4.37 and prior, modsession checks the session expiry time before decoding the session. This causes session expiry time to be ignored for modsessioncookie sessions since the expiry time is loaded when the session is decoded...

MGASA-2020-0066 Updated php packages fix security vulnerabilities

Updated php packages fix security vulnerabilities: Two buffer overflows in string and mbstring handling have been found CVE-2020-7059, CVE-2020-7060. Other security fixes have been applied: - Session: Fixed bug 79091 heap use-after-free in sessioncreateid. - Date: Fixed bug 79015 undefined-behavi...

CVE-2019-10158

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling...

Session fixation

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling...

CVE-2019-10158: Session Fixation

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling...

CVE-2019-11756

A use-after-free flaw was found in Mozilla Network Security Services NSS related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS...

The vulnerability of the libflycore library for working with session-based desktop sessions in the Astra Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the libflycore library for working with session-based desktop sessions in the Astra Linux operating system is related to the access to freed memory areas. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2019-6161

An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB Storage Block BMC in firmware versions prior to 1908.M. This vulnerability allows session IDs to be reused, which could provide unauthorized access to the BMC under certain...