Debian DLA-2403-1 : rails security update

A potential Cross-Site Scripting XSS vulnerability was found in rails, a ruby based MVC framework. Views that allow the user to control the default not found value of the t and translate helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing...

Fedora 33 : golang-github-andybalholm-brotli (2020-22d278923a)

Security fix for CVE-2020-8927 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Fedora 33 : f2fs-tools (2020-a0b24e9377)

Update to 1.14.0 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, Inc...

Fedora 33 : 1:libuv (2020-8dd4252dbe)

2020.09.26, Version 1.40.0 Stable Changes since version 1.39.0 : - udp: add UVUDPMMSGFREE recvcb flag Ryan Liptak - include: re-map UVEPROTO from 4046 to -4046 YuMeiJie - doc: correct UVUDPMMSGFREE version added cjihrig - doc: add uvmetricsidletime version metadata Ryan Liptak - win,tty: pass...

Fedora 33 : tpm2-tss (2020-1d3fcce2a3)

tpm2-tss 3.0.1 changed or fixed : Fix CVE-2020-24455 FAPI PolicyPCR not instatiating correctly Note that all TPM object created with a PolicyPCR with the currentPcrs and currentPcrsAndBank options have been created with an incorrect policy that ommits PCR checks. All these objects have to be...

Debian DLA-2399-1 : packagekit security update

Two vulnerabilities have been discovered in packagekit, a package management service. CVE-2020-16121 Vaisha Bernard discovered that PackageKit incorrectly handled certain methods. A local attacker could use this issue to learn the MIME type of any file on the system. CVE-2020-16122 Sami Niemimki...

Fedora 33 : mediawiki (2020-6e64e9d79e)

https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-Septembe r/000260.html https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-Septembe r/000262.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

Ubuntu 16.04 LTS : libseccomp-golang vulnerability (USN-4574-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4574-1 advisory. It was discovered that libseccomp-golang did not properly generate BPFs. If a process were running under a restrictive seccomp filter that specified multiple...

Fedora 32 : tpm2-tss (2020-bb8e3c5548)

tpm2-tss 2.4.3 changed or fixed : Fix CVE-2020-24455 FAPI PolicyPCR not instatiating correctly Note that all TPM object created with a PolicyPCR with the currentPcrs and currentPcrsAndBank options have been created with an incorrect policy that ommits PCR checks. All these objects have to be...

Fedora 31 : 1:libuv (2020-bc0050aa3d)

2020.09.26, Version 1.40.0 Stable Changes since version 1.39.0 : - udp: add UVUDPMMSGFREE recvcb flag Ryan Liptak - include: re-map UVEPROTO from 4046 to -4046 YuMeiJie - doc: correct UVUDPMMSGFREE version added cjihrig - doc: add uvmetricsidletime version metadata Ryan Liptak - win,tty: pass...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Spice vulnerability (USN-4572-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4572-1 advisory. Frediano Ziglio discovered that Spice incorrectly handled QUIC image decoding. A remote attacker could use this to cause Spice to crash,...

Ubuntu 16.04 LTS : rack-cors vulnerability (USN-4571-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4571-1 advisory. It was discovered that rack-cors did not properly handle relative file paths. An attacker could use this vulnerability to access arbitrary files. Tenable has...

RHEL 7 : qemu-kvm-rhev (RHSA-2020:4167)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4167 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provi...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : urllib3 vulnerability (USN-4570-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4570-1 advisory. It was discovered that urllib3 incorrectly handled certain character sequences. A remote attacker could possibly use this issue to perform...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Brotli vulnerability (USN-4568-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4568-1 advisory. It was discovered that Brotli incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash. Tenable has...

Ubuntu 16.04 LTS : Apache Tika vulnerabilities (USN-4564-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4564-1 advisory. It was discovered that Apache Tika can have an excessive memory usage by using a crafted or corrupt PSD file. An attacker could use it to cause a denial ...

Debian DLA-2393-1 : snmptt security update

It was found that SNMP Trap Translator does not drop privileges as configured and does not properly escape shell commands in certain functions. A remote attacker, by sending a malicious crafted SNMP trap, could possibly execute arbitrary shell code with the privileges of the process or cause a...

Fedora 32 : 2:podman / crun (2020-76fcd0ba34)

autobuilt v2.1.0, Security fix for CVE-2020-14370 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. ...

Debian DLA-2391-1 : ruby2.3 security update

A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick bundled along with ruby2.3 was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to...

Fedora 31 : mumble (2020-ca26a3f832)

Mumble 1.3.2. === Client - Fixed: Overlay not starting 4282 Server - Fixed: keychain-error on macOS for custom certificates 4345 Known issues - Overlay blocked by BattleEye. A request to whitelist it has been made. - Overlay blocked by CS:GO Trusted Mode Note that Tenable Network Security has...