Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 89 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 89.0.4389.72 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming...

Debian DSA-4862-1 : firefox-esr - security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or information disclosure. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

FreeBSD-SA-21:05.jail_chdir

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:05.jailchdir Security Advisory The FreeBSD Project Topic: jailattach2 relies on the caller to change the cwd Category: core Module: jail Announced: 2021-02-2...

Debian: Security Advisory (DSA-4858-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4856-1] php7.3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4856-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 17, 2021 https://www.debian.org/security/faq -...

CVE-2021-26559 CWE-284 Improper Access Control on Configurations Endpoint for the Stable API

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when webserver exposeconfig is set to False in airflow.cfg. This allowed a privilege escalation attack...

Apache Airflow 安全漏洞

Apache Airflow is an Apache project maintained by the open source community dedicated to scheduling and monitoring workflows, open sourced by Airbnb in October 2014 and graduated from the Apache Foundation in January 2019 to become the new Apache top-level project. Failure of proper access contro...

Debian DSA-4852-1 : openvswitch - security update

Joakim Hindersson discovered that Open vSwitch, a software-based Ethernet virtual switch, allowed a malicious user to cause a denial-of-service by sending a specially crafted packet. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Stable Channel Update for Desktop

The Stable channel has been updated to 88.0.4324.182 for Windows, Mac and Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by...

CVE-2020-22839

Reflected cross-site scripting vulnerability XSS in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers to inject arbitrary webscript or HTML code via the tab3 parameter...

Remote code execution

Zoho ManageEngine OpManager Stable build before 125203 and Released build before 125233 allows Remote Code Execution via the Smart Update Manager SUM servlet...

PT-2021-11573

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine OpManager versions prior to 125203 Stable build and prior to 125233 Released build Description: The issue allows Remote Code Execution via the Smart Update Manager SUM servlet. This can be exploited for malicious purposes...

Google Chrome < 88.0.4324.146 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 88.0.4324.146. It is, therefore, affected by multiple vulnerabilities as referenced in the 202102stable-channel-update-for-desktop advisory. - Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed...

Stable Channel Update for Desktop

The Stable channel has been updated to 88.0.4324.146 for Windows, Mac and Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by...

CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit)

Update Feb 3, 2021: It has been reported that macOS, AIX, and Solaris are also vulnerable to CVE-2021-3156, and that others may also still be vulnerable. Qualys has not independently verified the exploit. Original Post: The Qualys Research Team has discovered a heap overflow vulnerability in sudo...

CVE-2021-3156 "Baron Samedit"

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via “sudoedit -s” and a command-line argument that ends with a single backslash character. Recent assessments: cdelafuente-r7 at January 27, 2021 3:40pm UTC...

CVE-2020-36213

The CVE-2020-36213 issue affects the abi_stable crate for Rust prior to 0.9.1. A retain call can produce an invalid UTF-8 string, violating soundness and potentially undermining memory-safety guarantees. Documented impact centers on Rust crate soundness rather than explicit exploit paths in the p...

Fedora 33 : flatpak (2021-f970ea9d79)

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-f970ea9d79 advisory. - This updates flatpak from 1.8 to new 1.10 stable series. The major new feature in this series compared to 1.8 is the support for the new repo format which...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 88 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 88.0.4324.96 for Mac and Linux and 88.0.4324.104 for windows contains a number of fixes and improvements -- a list of changes...

[SECURITY] [DSA 4833-1] gst-plugins-bad1.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4833-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 18, 2021 https://www.debian.org/security/faq -...