perl-IO-Socket-SSL:2.066 and perl-libwww-perl:6.34 update

An update is available for perl-IO-HTML, perl-LWP-MediaTypes, perl-Data-Dump, perl-Net-HTTP, perl-HTTP-Message, perl-Try-Tiny, perl-Digest-HMAC, perl-HTML-Parser, perl-NTLM, perl-Mozilla-CA, perl-IO-Socket-SSL, perl-libwww-perl, perl-Encode-Locale, perl-HTTP-Negotiate, perl-File-Listing,...

perl-IO-Socket-SSL:2.066 and perl-libwww-perl:6.34 update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

UBUNTU-CVE-2020-25650

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path /run/spice-vdagentd/spice-vdagent-sock could use this flaw to perform a memory denial of service f...

CVE-2020-25652

A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in /run/spice-vdagentd/spice-vdagent-sock. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to th...

EulerOS 2.0 SP2 : dbus (EulerOS-SA-2020-2339)

According to the version of the dbus packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in dbus = 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message...

PT-2020-16148 · Red Hat +7 · Spice-Vdagent +8

Name of the Vulnerable Software and Affected Versions: spice-vdagent versions 0.20 and prior Description: A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in /run/spice-vdagentd/spice-vdagent-sock...

UBUNTU-CVE-2020-25652

A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in /run/spice-vdagentd/spice-vdagent-sock. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to th...

CVE-2020-25673

A vulnerability was found in Linux kernel where non-blocking socket in llcpsockconnect leads to leak and eventually hanging-up the system...

PT-2020-6654 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: The issue is related to the use of memory after it has been freed in the llcp sock connect function. This could potentially allow an attacker to escalate their privileges. The problem ...

Debian DLA-2420-2 : linux regression update

This update corrects a regression in some Xen virtual machine environments. For reference the original advisory text follows. Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information...

UBUNTU-CVE-2020-25671

A vulnerability was found in Linux Kernel, where a refcount leak in llcpsockconnect causing use-after-free which might lead to privilege escalations...

UBUNTU-CVE-2020-25673

A vulnerability was found in Linux kernel where non-blocking socket in llcpsockconnect leads to leak and eventually hanging-up the system...

Insecure Defaults

Overview socket.io is a node.js realtime framework server. Affected versions of this package are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. Remediation Upgrade socket.io to version 2.4.0 or higher. References - GitHub Issue - HackerOne...

puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL

A flaw was found in Puppet, where the Puppet Agent did not verify the peer in the SSL connection before downloading to the Certificate Revocation List CRL. The primary risk is the availability of communications to computing systems and not Puppet itself. This flaw allows an attacker to submit a...

The vulnerability of microprogrammed software in server boards, server systems, and Intel computing modules, related to authentication deficiencies, allows attackers to escalate their privileges.

The vulnerability of socket services in microprogramming software for server boards, server systems, and Intel computing modules is related to authentication deficiencies. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

The vulnerability of microprogrammed software in server boards, server systems, and Intel computing modules, related to authentication deficiencies, allows attackers to escalate their privileges.

The vulnerability of socket services in microprogramming software for server boards, server systems, and Intel computing modules is related to authentication deficiencies. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

The vulnerability of microprogrammed software in server boards, server systems, and Intel computing modules, related to authentication deficiencies, allows attackers to escalate their privileges.

The vulnerability of socket services in microprogramming software for server boards, server systems, and Intel computing modules is related to authentication deficiencies. Exploiting this vulnerability can allow attackers to enhance their privileges...

Microsoft Open Enclave SDK Information Disclosure Vulnerability (CNVD-2020-64264)

Microsoft Open Enclave SDK is a Microsoft SDK Software Development Kit for building secure zone applications in C and C ++. A security vulnerability exists in Open Enclave versions prior to 0.12.0 that stems from an information disclosure vulnerability that exists when an Enclave application uses...

Mikrot8Over - Fast Exploitation Tool For Mikrotik RouterOS

mikrot8over: Fast exploitation tool for Mikrotik RouterOS up to 6.38.4 This is reworked original Mikrotik Exploit. Added Python 2 compatibility and multithreading scan features. Python version Utility was tested on a python2.6 , python2.7 , python3. If you have found any bugs, don't hesitate to...

SUSE-SU-2020:2920-1 Security update for php7

This update for php7 fixes the following issues: - CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names bsc1177352. - Added tmpfiles.d for php-fpm to provide a base for a socket bsc1173786...