Fedora 30 : PyYAML (2020-40c35d7b37)

New upstream release 5.3.1 rhbz1814882 - Fixes CVE-2020-1747 rhbz1807367,1809011 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Scientific Linux Security Update : ipmitool on SL7.x x86_64 (20200327)

Security Fixes : - ipmitool: Buffer overflow in readfruareasection function in lib/ipmifru.c CVE-2020-5208 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135002; scriptversion"1.4";...

Fedora 31 : python-twisted (2020-16dc0da400)

Security fix for CVE-2020-10108 1813439, 1813441 Security fix for CVE-2020-10109 1813447, 1813449 ---- Own %pythonXsitelib/twisted/plugins Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

RHEL 7 : ipmitool (RHSA-2020:0984)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0984 advisory. The ipmitool packages contain a command-line utility for interfacing with devices that support the Intelligent Platform Management Interface IPMI...

Debian DLA-2158-1 : ruby2.1 security update

An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer 'head' allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array...

RHEL 8 : zsh (RHSA-2020:0978)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0978 advisory. The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell the...

SUSE SLED15 / SLES15 Security Update : cloud-init (SUSE-SU-2020:0751-1)

This update for cloud-init fixes the following security issues : CVE-2020-8631: Replaced the theoretically predictable deterministic RNG with the system RNG bsc1162937. CVE-2020-8632: Increased the default random password length from 9 to 20 bsc1162936. Note that Tenable Network Security has...

UCM6202 1.0.18.13 - Remote Command Injection Exploit

Exploit for hardware platform in category web applications Exploit Title: UCM6202 1.0.18.13 - Remote Command Injection Exploit Author: Jacob Baines Vendor: http://www.grandstream.com Product Link: http://www.grandstream.com/products/ip-pbxs/ucm-series-ip-pbxs/product/ucm6200-series Tested on:...

Fedora 31 : timeshift (2020-6b3ae09449)

Security fix for CVE-2020-10174 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Fedora 31 : chromium (2020-7fd051b378)

Update to 80.0.3987.149. Upstream says it fixes '13' security issues, but only lists these CVEs : - CVE-2020-6422: Use after free in WebGL - CVE-2020-6424: Use after free in media - CVE-2020-6425: Insufficient policy enforcement in extensions. - CVE-2020-6426: Inappropriate implementation in V8 -...

RHEL 6 : python-imaging (RHSA-2020:0898)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0898 advisory. The Python Imaging Library PIL adds image processing capabilities to your Python interpreter. This library provides extensive file format support, an...

Debian DLA-2152-1 : graphicsmagick security update

A vulnerability was discovered in graphicsmagick, a collection of image processing tools, that allows allows an attacker to read arbitrary files via a crafted image because of TranslateTextEx for SVG. For Debian 8 'Jessie', this problem has been fixed in version 1.3.20-3+deb8u9. We recommend that...

Debian DLA-2151-1 : icu security update

It was discovered that an integer overflow in the International Components for Unicode ICU library could result in denial of service and potentially the execution of arbitrary code. For Debian 8 'Jessie', this problem has been fixed in version 52.1-8+deb8u8. We recommend that you upgrade your icu...

Debian DLA-2149-1 : rails security update

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j or escapejavascript methods may be susceptible to XSS attacks. For Debian 8 'Jessie', this problem has been fixed in version...

Trend Micro Fixes Critical Flaws Under Attack

Trend Micro has released security updates patching five vulnerabilities in its endpoint security solutions, Apex One and OfficeScan XG for Windows. Specifically, Apex One 2019 and OfficeScan XG SP1 and XG are affected by four critical-severity and one high-severity flaws. Two of these...

Trend Micro Fixes Critical Flaws Under Attack

Trend Micro has released security updates patching five vulnerabilities in its endpoint security solutions, Apex One and OfficeScan XG for Windows. Specifically, Apex One 2019 and OfficeScan XG SP1 and XG are affected by four critical-severity and one high-severity flaws. Two of these...

Fedora 30 : php-horde-Horde-Form (2020-a69f99bc67)

HordeForm 2.0.20 - mjr SECURITY: Prevent ability to specify temporary filename CVE-2020-8866, Reported By: Andrea Cardaci working with Trend Micro Zero Day Initiative. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

Ubuntu 16.04 LTS : Linux kernel vulnerability (USN-4303-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4303-1 advisory. Paulo Bonzini discovered that the KVM hypervisor implementation in the Linux kernel could improperly let a nested level 2 guest access the resources of a parent...

Fedora 31 : php-horde-Horde-Form (2020-a55b70b4ab)

HordeForm 2.0.20 - mjr SECURITY: Prevent ability to specify temporary filename CVE-2020-8866, Reported By: Andrea Cardaci working with Trend Micro Zero Day Initiative. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

RHEL 8 : firefox (RHSA-2020:0820)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0820 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...