Security update for git (moderate)

openSUSE Security Update: Security update for git Announcement ID: openSUSE-SU-2020:0598-1 Rating: moderate References: 1063412 1095218 1095219 1110949 1112230 1114225 1132350 1149792 1156651 1158785 1158787 1158788 1158789 1158790 1158791 1158792 1158793 1158795 1167890 1168930 1169605 1169786...

CVE-2020-7453

In FreeBSD 12.1-STABLE before r359021, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r359020, and 11.3-RELEASE before 11.3-RELEASE-p7, a missing null termination check in the jailset configuration option "osrelease" may return more bytes with a subsequent jailget system call allowing a...

The vulnerability in the collection of libraries and drivers for fast packet processing in dpdk, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of the library and driver set for fast packet processing in dpdk is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted VRINGSETNUM messages...

CVE-2020-7453

CVE-2020-7453 affects FreeBSD 12.1-STABLE before r359021, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r359020, and 11.3-RELEASE before 11.3-RELEASE-p7. A missing NULL-termination check in the jail_set configuration option "osrelease" may cause jail_get to return more bytes than were s...

systemd: services with DynamicUser can get new privileges and create SGID binaries

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow a cooperating process to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to...

systemd: services with DynamicUser can create SUID/SGID binaries

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially...

dpdk: possible memory leak leads to denial of service

A flaw was found in dpdk where a malicious master, or a container with access to vhostuser socket, can send specially crafted VRINGSETNUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition...

wavpack: Use of uninitialized variable in WavpackSetConfiguration64 leads to DoS

WavpackSetConfiguration64 in packutils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service application crash via a DFF file that lacks valid sample-rate data...

wawpack: Infinite loop in WavpackPackInit function lead to DoS

The function WavpackPackInit in packutils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service resource exhaustion caused by an infinite loop via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero...

PT-2020-5991

Name of the Vulnerable Software and Affected Versions Lodash versions prior to 4.17.20 Lodash versions prior to 4.17.19 Description The issue is related to a prototype pollution attack when using the .zipObjectDeep function in Lodash. This can lead to denial of service or code execution under...

EpiphanyCoin has a flawed logic vulnerability

EpiphanyCoin is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in EpiphanyCoin's smart contract implementation. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...

Evenroute IQrouter has an unspecified vulnerability (CNVD-2020-25366)

Evenroute IQrouter is an intelligent router from Evenroute USA. A security vulnerability exists in the 'diagsetpassword' function in the web panel in Evenroute IQrouter 3.3.1 and earlier versions. A remote attacker can exploit this vulnerability to arbitrarily change the root account password...

CVE-2020-11964

In IQrouter through 3.3.1, the Lua function diagsetpassword in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

(Pwn2Own) Triangle MicroWorks SCADA Data Gateway DNP3 Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of data set elements. The issue results from the lac...

ZSQL: Log File Permission

The LOGFILEPERMISSIONS parameter specifies the log file permission. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 31 : bubblewrap (2020-a4206f14f1)

Update to 0.4.1 This release fixes a privilege escalation bug pointed out by Stephen Rttger, where in some setups bubblewrap can be used to gain root permissions. Only version 0.4.0 is vulnerable, and only if installed setuid while at the same time the kernel supports unprivileged user namespaces...

(Pwn2Own) Triangle MicroWorks SCADA Data Gateway DNP3 Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists with the handling of data set descriptors. The issue results fro...

SUSE SLES12 Security Update : git (SUSE-SU-2020:0992-1)

This update for git fixes the following issues : Security issue fixed : CVE-2020-5260: With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a wrong host bsc1168930. Non-security issue fixed : git was updated to 2.26.0 f...

The vulnerabilities of the functions hci_uart_register_dev() and hci_uart_set_proto() in the Linux operating system allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerabilities of the functions hciuartregisterdev and hciuartsetproto drivers/bluetooth/hcildisc.c in the Linux operating system are related to the use of memory after it is freed. Exploiting these vulnerabilities could allow an attacker to compromise the confidentiality, integrity, and...

Description of the security update for SharePoint Server 2013: May 9, 2017

Description of the security update for SharePoint Server 2013: May 9, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...