ALBA-2021:1709 popt bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

GHSA-567X-M4WM-87V8 Infinite loop in Apache Tika

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later...

Infinite loop in Apache Tika

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later...

PT-2021-18201 · Netmask · Netmask

Name of the Vulnerable Software and Affected Versions: netmask package versions prior to 2.0.1 Description: The issue arises from the netmask package's mishandling of certain unexpected characters in an IP address string. Specifically, it struggles with octal digits, such as the digit 9, under...

General procedure for xenserver/citrix hypervisor upgrade

General procedure for xenserver/citrix hypervisor upgrade...

Release Notes for Veeam Backup & Replication 11 Day 0 Update

This "Day 0" update is intended only for environments where Veeam Backup & Replication 11 RTM 11.0.0.825 is installed. If you are running Veeam Backup & Replication 11 GA build 11.0.0.837 or later, this update is not applicable to you, and should be ignored. Requirements This update enables...

CVE-2020-11988

Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users...

GHSA-4PH2-8337-HM62 Key Caching behavior in the DynamoDB Encryption Client.

Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider, time-based key reauthorization logic in...

SUSE-SU-2021:0107-1 Security update for nodejs14

This update for nodejs14 fixes the following issues: - New upstream LTS version 14.15.4: CVE-2020-8265: use-after-free in TLSWrap High bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as...

CVE-2020-8942

An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to encuntrustedread whose return size was not validated against the requrested size. The parameter size is unchecked allowing the attacker to read memory locations outside of the...

HPESBNW04072 rev.2 - HPE ArubaOS, Multiple Remote Vulnerabilities

Potential Security Impact: Remote: Arbitrary Code Execution, Arbitrary Command Execution, Compromise of System Integrity SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba 7000 Series Mobility Controllers 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and bel...

DEBIAN-CVE-2020-26237

Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow use...

CVE-2020-3284

A vulnerability in the enhanced Preboot eXecution Environment PXE boot loader for Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to execute unsigned code during the PXE boot process on an affected device. The PXE boot loader is part of the BIOS and runs over the...

CVE-2020-3284 Cisco IOS XR Software Enhanced Preboot eXecution Environment Unsigned Code Execution Vulnerability

A vulnerability in the enhanced Preboot eXecution Environment PXE boot loader for Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to execute unsigned code during the PXE boot process on an affected device. The PXE boot loader is part of the BIOS and runs over the...

PT-2020-16537 · Lightning Network Daemon · Lnd

Name of the Vulnerable Software and Affected Versions: LND versions prior to 0.10.0-beta Description: The issue allows any peer with an open channel to exploit the vulnerability, regardless of the victim's situation, such as being a routing node, payment-receiver, or payment-sender. This can lead...

Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls

Impact The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints. Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version...

Ability to switch customer email address on account detail page and stay verified

Impact The user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any...

Obsolete versions of the `rustsec` crate do not support the new V3 advisory format

If you are seeing this message, you are running an obsolete version of cargo-audit which does not support the new V3 advisory format. These versions are end-of-life. This advisory is a notice that that it will soon be unable to parse the advisory database. Please upgrade cargo-audit to a newer...

PYSEC-2020-326

In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indice...

GHSA-HJMQ-236J-8M87 Denial of service in tensorflow-lite

Impact In TensorFlow Lite models using segment sum can trigger a denial of service by causing an out of memory allocation in the implementation of segment sum. Since code uses the last element of the tensor holding them to determine the dimensionality of output tensor, attackers can use a very...