Important: yum-utils

Issue Overview: A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system...

Scientific Linux Security Update : yum-utils on SL6.x (noarch) (20180730)

Security Fixes : - yum-utils: reposync: improper path validation may lead to directory traversal CVE-2018-10897 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid111496; scriptversion"1.5";...

RHEL 6 : yum-utils (RHSA-2018:2284)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2284 advisory. - yum-utils: reposync: improper path validation may lead to directory traversal CVE-2018-10897 Note that Nessus has not tested for this issue but has...

Scientific Linux Security Update : yum-utils on SL7.x (noarch) (20180730)

Security Fixes : - yum-utils: reposync: improper path validation may lead to directory traversal CVE-2018-10897 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid111497; scriptversion"1.5";...

Oracle Linux 6 : yum-utils (ELSA-2018-2284)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-2284 advisory. 1.1.30-42.0.1 - add dependency btrfs-progs for yum-plugin-fs-snapshot [email protected] bug 16285176 - use unified btrfs binary instead of btrfsctl...

RHEL 7 : yum-utils (RHSA-2018:2285)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2285 advisory. The yum-utils packages provide a collection of utilities and examples for the yum package manager to make yum easier and more powerful to use. Securi...

Oracle Linux 7 : yum-utils (ELSA-2018-2285)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-2285 advisory. 1.1.31-46.0.1 - needs-restarting not checking kernel-uek for reboot message Orabug 27189714 - add bug27596617.patch to remove upstream URL reference 1.1.31-46 -...

CVE-2018-10897

A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path...

CVE-2018-10897

CVE-2018-10897 affects reposync, a component of yum-utils. The vulnerability arises from improper path sanitization in remote repository configuration files, enabling a directory traversal that could allow copying files outside the destination directory. If reposync runs with elevated privileges,...

CVE-2018-10897

Removed by vendor...

CVE-2018-10897

A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path...

CVE-2018-10897: Improper Link Resolution Before File Access

A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path...

Important: Red Hat Security Advisory: yum-utils security update

An update for yum-utils is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Important: Red Hat Security Advisory: yum-utils security update

An update for yum-utils is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

PT-2018-2217 · Yum +2 · Yum-Utils +2

Name of the Vulnerable Software and Affected Versions: yum-utils versions 1.1.31 and older Description: A directory traversal issue exists in reposync, a part of yum-utils, due to insufficient path sanitization in remote repository configuration files. This allows an attacker controlling a...

yum-utils security update

1.1.31-46.0.1 - needs-restarting not checking kernel-uek for reboot message Orabug 27189714 - add bug27596617.patch to remove upstream URL reference 1.1.31-46 - reposync: prevent path traversal. - Resolves: bug1600617...

yum-utils security update

1.1.30-42.0.1 - add dependency btrfs-progs for yum-plugin-fs-snapshot [email protected] bug 16285176 - use unified btrfs binary instead of btrfsctl [email protected] bug 16285176 -1.1.30-42 - reposync: prevent path traversal. - Resolves: bug1600619...

Bento4 Buffer Overflow Vulnerability (CNVD-2018-14698)

Bento4 is an open source C++ library for reading and writing MP4 files. A heap buffer overflow vulnerability exists in AP4BytesToUInt16BE in the Core/Ap4Utils.h file in Bento4 version 1.5.1-624. An attacker can exploit this vulnerability to cause a heap buffer out-of-bounds read...

django_make_app is vulnerable to Code Injection

An exploitable vulnerability exists in the YAML parsing functionality in the readyamlfile method in ioutils.py in djangomakeapp 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability...

GHSA-CWH5-3CW7-4286 tlslite-ng off-by-one error on mac checking

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line endpos = datalen - 1 - mac.digestsize that can...