SUSE-SU-2020:1657-2 Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues: Docker was updated to 19.03.11-ce runc was updated to version 1.0.0-rc10 containerd was updated to version 1.2.13 - CVE-2020-13401: Fixed an issue where an attacker with CAPNETRAW...

PT-2020-3363

Name of the Vulnerable Software and Affected Versions Oracle Java SE version 8u251 Description The issue is related to insufficient input validation in the JavaFX component, allowing an unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks...

Security Advisory - Apache Tomcat File Inclusion Vulnerability

There is a file inclusion vulnerability in the implementation of the AJP protocol in Apache Tomcat. Attackers can send malicious AJP requests to exploit this vulnerability. Successful exploit could cause the remote attacker read any file in a specified directory without authorization. Vulnerabili...

Security Advisory - Stack Overflow Vulnerability in Huawei Smart Phone Product

There is a stack overflow vulnerability in some Huawei smart phone. An attacker can craft specific packet to exploit this vulnerability. Due to insufficient verification, this could be exploited to tamper with the information to affect the availability. Vulnerability ID: HWPSIRT-2019-11030 This...

Security Advisory - Improper Authentication Vulnerability in Several Smartphones

There is an improper authentication vulnerability in several smartphones. The system does not sufficiently validate certain parameter passed from the bottom level, the attacker should trick the user into installing a malicious application and control the bottom level, successful exploit could cau...

PT-2020-3444 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: Oracle MySQL Server versions 8.0.20 and prior Description: The issue is related to insufficient access control in the Server: Parser component of Oracle MySQL Server. It can be exploited by a remote attacker to cause a denial of service using...

Threat spotlight: WastedLocker, customized ransomware

WastedLocker is a new ransomware operated by a malware exploitation gang commonly known as the Evil Corp gang. The same gang that is associated with Dridex and BitPaymer. The attribution is not based on the malware variants as WastedLocker is very different from BitPaymer. What was kept was the...

OPENSUSE-SU-2020:0949-1 Security update for opera

This update for opera fixes the following issues: - Update to version 69.0.3686.49 - CHR-7971 Update chromium on desktop-stable-83-3686 to 83.0.4103.116 CVE-2020-6509 - DNA-79195 Wrong date on history - DNA-86090 Crash at views::View::ReorderChildViewviews::View, int - DNA-86122 Mac Some popovers...

SUSE-SU-2020:1553-2 Security update for libexif

This update for libexif to 0.6.22 fixes the following issues: Security issues fixed: - CVE-2016-6328: Fixed an integer overflow in parsing MNOTE entry data of the input file bsc1055857. - CVE-2017-7544: Fixed an out-of-bounds heap read vulnerability in exifdatasavedataentry function in...

DLA-2273-1 shiro - security update

Bulletin has no description...

MGASA-2020-0272 Updated vlc packages fix security vulnerability

Updated vlc packages fixes security vulnerability: A heap-based buffer overflow in the hxxxAnnexBtoxVC function in modules/packetizer/hxxxnal.c in VideoLAN VLC media player before 3.0.11 allows remote attackers to cause a denial of service application crash or execute arbitrary code via a crafted...

MGASA-2020-0271 Updated libxml2 packages fix security vulnerability

Updated libxml2 packages fix security vulnerability: The fix for CVE-2019-19956 introduced regressions which can cause invalid xmlns references in output and memory leaks, possibly leading to more serious security issues. The broken fix has been reverted...

PT-2020-6924 · Bouncy Castle +1 · Bouncy Castle Bc C# .Net +3

Name of the Vulnerable Software and Affected Versions: Bouncy Castle BC Java versions 1.65 and earlier Bouncy Castle BC C .NET versions 1.8.6 and earlier Bouncy Castle BC-FJA versions 1.0.2.0 and earlier Bouncy Castle BC-FNA versions 1.0.1.0 and earlier Description: The issue is related to a timi...

SUSE-SU-2020:1841-1 Security update for tomcat

This update for tomcat fixes the following issues: Tomcat was updated to 9.0.36 See changelog at - CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU usage for several seconds making potentially the server unresponsive...

The vulnerability of the software update service for Cisco Webex Meetings Desktop App allows a perpetrator to execute arbitrary code.

The vulnerability of the software update service for the Cisco Webex Meetings Desktop App is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

OPENSUSE-SU-2020:0917-1 Security update for opera

This update for opera fixes the following issues: Opera was updated to version 68.0.3618.104 - CHR-7909 Update chromium on desktop-stable-81-3618 to 81.0.4044.138 - CVE-2020-6831, CVE-2020-6464 - DNA-85609 Mac Tabs shrinking & disappearing - DNA-85629 Crash at...

Cisco Small Business Smart and Managed Switches Session Management Vulnerability

A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface. The attacker could obtain the...

Security Advisory - Improper Signature Verification Vulnerability in Some Huawei Smartphones

There is an improper signature verification vulnerability in some smartphones. The system does not improper check signature of specific software package, an attacker may exploit this vulnerability to load a crafted software package to the device. Vulnerability ID: HWPSIRT-2019-11220 This...

Security Advisory - Use After Free Vulnerability in Several Smartphones

There is a use after free vulnerability in several smartphones. There is a condition exists that the system would reference memory after it has been freed, the attacker should trick the user into running a crafted application with common privilege, successful exploit could cause code execution...

PT-2020-14029 · Philips · Philips Ultrasound Cx +4

Name of the Vulnerable Software and Affected Versions: Philips Ultrasound ClearVue versions 3.2 and prior Philips Ultrasound CX versions 5.0.2 and prior Philips Ultrasound EPIQ/Affiniti versions VM5.0 and prior Philips Ultrasound Sparq version 3.0.2 and prior Philips Ultrasound Xperius all versio...