MGASA-2020-0234 Updated sleuthkit packages fix security vulnerability

Updated sleuthkit packages fix security vulnerabilities: An issue was discovered in The Sleuth Kit TSK 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table CVE-2019-14532. In version 4.8.0 and earlier of The Sleuth Kit TSK, there ...

MGASA-2020-0231 Updated nginx packages fix security vulnerability

Nginx was updated due to the following vulnerabilities: ngxhttpspecialresponse.c: With a certain errorpage configuration, HTTP request smuggling is possible. Thus, an attacker may be able to read unauthorized web pages at times when NGINX is being fronted by a load balancer. CVE-2019-20372...

Security Advisory - Denial of Service Vulnerability in Some Huawei Products

There is a denial of service vulnerability in some Huawei products. Due to improper memory management, memory leakage may occur in some special cases. Attackers can perform a series of operations to exploit this vulnerability. Successful exploit may cause a denial of service. Vulnerability ID:...

Security Advisory - Improper Authorization Vulnerability in Several Smartphones

There is an improper authorization vulnerability in several smartphones. The digital balance function does not sufficiently restrict the using time of certain user, successful exploit could allow the user break the limit of digital balance function after a series of operations with a PC...

Security Advisory - Improper Authorization Vulnerability in Several Smartphones

There is an improper authorization vulnerability in several smartphones. The system does not properly restrict certain operation in ADB mode, successful exploit could allow certain user break the limit of digital balance function. Vulnerability ID: HWPSIRT-2019-08104 This vulnerability has been...

Security Advisory - Improper Authentication Vulnerability in Several Smartphones

There is an improper authentication vulnerability in several smartphones. A logic error occurs when handling clock function, an attacker should do a series of crafted operations quickly before the phone is unlocked, successful exploit could allow the attacker to access clock information without...

Huawei Data Communication: Security Vulnerability (huawei-sa-20200131-01-jin)

Huawei iManager N2510 devices are prone to a security vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Huawei Data Communication: Multiple Buffer Overflow Vulnerabilities in Some Huawei Products (huawei-sa-20171201-01-sip)

There are three buffer overflow vulnerabilities in the SIP backup feature of some Huawei products. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Huawei Data Communication: Memory Leak Vulnerability in Some Huawei Products (huawei-sa-20171201-01-router)

Some Huawei products have a memory leak vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you ca...

OPENSUSE-SU-2020:0711-1 Security update for tomcat

This update for tomcat fixes the following issues: - Update to Tomcat 9.0.35. See changelog at http://tomcat.apache.org/tomcat-9.0-doc/changelog.htmlTomcat9.0.35markt CVE-2020-9484 bsc1171928 Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the conten...

MGASA-2020-0225 Updated wireshark packages fix security vulnerability

Updated wireshark packages fix security vulnerability: The NFS dissector could crash...

MGASA-2020-0224 Updated unbound packages fix security vulnerabilities

Updated unbound packages fix security vulnerabilities: Unbound can be tricked into amplifying an incoming query into a large number of queries directed to a target CVE-2020-12662. Malformed answers from upstream name servers can be used to make Unbound unresponsive CVE-2020-12663...

MGASA-2020-0219 Updated libntlm packages fix security vulnerability

Updated libntlm packages fix security vulnerability: It was discovered that libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in...

MGASA-2020-0216 Updated nmap packages fix security vulnerability

Updated nmap packages fix security vulnerability: nselibssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n character to ssh-brute.nse or ssh-auth-methods.nse CVE-2017-18594. Also, when a server forced...

OPENSUSE-SU-2020:0698-1 Security update for pdns-recursor

This update for pdns-recursor fixes the following issues: - update to 4.1.16 fixes an issue where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated CVE-2020-12244, boo1171553 fixes an issue where invalid hostname on the server can result in disclosure...

OPENSUSE-SU-2020:0677-1 Security update for file

This update for file fixes the following issues: Security issues fixed: - CVE-2019-18218: Fixed a heap-based buffer overflow in cdfreadpropertyinfo bsc1154661. Non-security issue fixed: - Fixed broken '--help' output bsc1169512. This update was imported from the SUSE:SLE-15:Update update project...

SUSE-SU-2020:1383-1 Security update for dom4j

This update for dom4j fixes the following issues: - CVE-2020-10683: Fixed an XML External Entity vulnerability in default SAX parser bsc1169760...

Apache Camel Netty enables Java deserialization by default

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0...

SUSE-SU-2020:1363-1 Security update for tomcat

This update for tomcat fixes the following issues: - Update to Tomcat 9.0.35. See changelog at http://tomcat.apache.org/tomcat-9.0-doc/changelog.htmlTomcat9.0.35markt CVE-2020-9484 bsc1171928 Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the conten...

PT-2020-10774 · Gila · Gila Cms

Name of the Vulnerable Software and Affected Versions: Gila CMS versions prior to 1.11.6 Description: The issue allows for CSRF with resultant XSS via the "admin/themes" URI, potentially leading to the compromise of the admin account. Recommendations: For versions prior to 1.11.6, update to versi...