Security Advisory - Memory Leak Vulnerability in Some Firewall Products

There is a memory leak vulnerability in some firewall products. The software does not sufficiently track and release allocated memory while parse certain message, the attacker sends the message continuously that could consume remaining memory. Successful exploit could cause memory exhaust...

Security Advisory - Denial of Service Vulnerability in Some Huawei Firewall Products

There is a Denial of Service DoS vulnerability in some firewall products. Due to improper processing of specific IPSEC packets, remote attackers can send constructed IPSEC packets to affected devices to exploit this vulnerability. Successful exploit could cause the IPSEC function of the affected...

Security Advisory - Small OOB Read Vulnerability in Huawei Product

There is an out-of-bound read vulnerability that a memory management error exists when IPSec Module handing a specific message. Attackers can send specific message to cause 1 byte out-of-bound read, compromising normal service. Vulnerability ID: HWPSIRT-2019-12417 This vulnerability has been...

OPENSUSE-SU-2020:0207-1 Security update for wicked

This update for wicked fixes the following issues: - CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IAPD option bsc1160904. - CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids bsc1160906. This update was imported from the...

Intel® SGX SDK Advisory

Summary: A potential security vulnerability in Intel® Software Guard Extensions SGX SDK may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2020-0561 Description: Improper initialization in the IntelR S...

DLA-2100-1 libexif - security update

Bulletin has no description...

Security Advisory - Information Leak Vulnerability in Some Huawei Products

There is an information leak vulnerability in some Huawei products. An unauthenticated, remote attacker can make a large number of attempts to guess information. Successful exploitation may cause information leak. Vulnerability ID: HWPSIRT-2019-10453 This vulnerability has been assigned a Common...

Movable Type vulnerable to cross-site scripting

Overview Movable Type provided by Six Apart Ltd. contains a cross-site scripting vulnerability CWE-79 in block editor and rich text editor. Six Apart Ltd. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Six Apart Ltd. coordinated under the...

Cisco Digital Network Architecture Center Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Digital Network Architecture DNA Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is...

Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability

A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisc...

Cisco NX-OS Software Cisco Discovery Protocol Remote Code Execution Vulnerability

A vulnerability in the Cisco Discovery Protocol implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability exists because the Cisco Discovery Protocol parser does not properly...

PT-2020-1882 · Cisco · Cisco Dna Center

Name of the Vulnerable Software and Affected Versions: Cisco DNA Center Software versions prior to 1.3.0.6 Cisco DNA Center Software versions prior to 1.3.1.4 Description: The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affect...

OPENSUSE-SU-2020:0165-1 Security update for wicked

This update for wicked fixes the following issues: - CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options bsc1160903. - CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 bsc1160905...

PT-2020-6382

Name of the Vulnerable Software and Affected Versions DrayTek Vigor3900 versions 1.4.4 Beta and earlier DrayTek Vigor2960 versions 1.3.1 Beta and earlier DrayTek Vigor300B versions 1.3.3 Beta, 1.4.2.1 Beta, and 1.4.4 Beta Description The issue is related to the WebUI interface of DrayTek Vigor...

DLA-2092-1 qtbase-opensource-src - security update

Bulletin has no description...

DLA-2090-1 qemu - security update

Bulletin has no description...

MGASA-2020-0072 Updated mariadb packages fix security vulnerability

Updated MariaDB packages fix security vulnerabilities: Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequentl...

MGASA-2020-0050 Updated opencontainers-runc packages fix security vulnerability

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory CVE-2019-16884...

OPENSUSE-SU-2020:0113-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: Update to version jdk-11.0.6-10 January 2020 CPU, bsc1160968 Fixing these security related issues: - CVE-2020-2583: Unlink Set of LinkedHashSets - CVE-2020-2590: Improve Kerberos interop capabilities - CVE-2020-2593: Normalize...

CVE-2020-3142

A vulnerability in Cisco Webex Meetings Suite sites and Cisco Webex Meetings Online sites could allow an unauthenticated, remote attendee to join a password-protected meeting without providing the meeting password. The connection attempt must initiate from a Webex mobile application for either iO...