OPENSUSE-SU-2020:2024-1 Security update for blueman

This update for blueman fixes the following issues: - Update to version 2.1.4 CVE-2020-15238: Fixed a local denial-of-service in the D-Bus interface boo1178196 This update was imported from the openSUSE:Leap:15.2:Update update project...

OPENSUSE-SU-2020:1993-1 Security update for rmt-server

This update for rmt-server fixes the following issues: Update to version 2.6.5: - Solved potential bug of SCC repository URLs changing over time. RMT now self heals by removing the previous invalid repository and creating the correct one. - Add web server settings to /etc/rmt.conf: Now it's...

PT-2020-18894 · Google +1 · Libprotobuf +1

Name of the Vulnerable Software and Affected Versions: Valve's Game Networking Sockets versions prior to v1.2.0 Description: The issue arises from improper handling of inlined statistics messages in the CConnectionTransportUDPBase::Received Data function, leading to an exception thrown from...

OPENSUSE-SU-2020:1834-1 Security update for tmux

This update for tmux fixes the following issues: - Update to version 3.1c Fix a stack overflow on colon-separated CSI parsing. boo1178263 CVE-2020-27347 - tmux 3.1b: Fix crash when allow-rename ison and an empty name is set - tmux 3.1a: Do not close stdout prematurely in control mode since it is...

PT-2021-2237 · Gstreamer +3 · Gst-Plugins-Bad +3

Name of the Vulnerable Software and Affected Versions: gst-plugins-bad versions prior to 1.18.1 Description: A flaw was found in the gstreamer h264 component where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution. The...

GHSA-P68V-FRGX-4RJP Denial of Service via Cache Flooding

Impact Denial of Service via Cache Flooding Patches We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of 6.1...

PT-2020-5800 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.5.2 Description: The issue is related to insufficient protection measures for web page structures in the WordPress content management system, allowing for potential data integrity impact by a remote attacker. It ...

SUSE-RU-2020:2915-1 Recommended update for bind

This update for bind fixes the following issues: Bind was updated to version 9.11.22 Note: - bind is now more strict in regards to DNSSEC. If queries are not working, check for DNSSEC issues. For instance, if bind is used in a namserver forwarder chain, the forwarding DNS servers must support...

PT-2020-15522 · Jenkins · Jenkins Release Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Release Plugin versions 2.10.2 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This occurs because the release version in the badge tooltip is not properly escaped. Attackers with...

OPENSUSE-SU-2020:1611-1 Security update for grafana

This update for grafana fixes the following issues: grafana was updated to version 7.1.5: Features / Enhancements - Stats: Stop counting the same user multiple times. - Field overrides: Filter by field name using regex. - AzureMonitor: map more units. - Explore: Don't run queries on datasource...

PT-2020-15849 · Libraw +1 · Libraw +1

Name of the Vulnerable Software and Affected Versions: LibRaw versions prior to 20.0 Description: A buffer overflow issue in the GetNormalizedModel function within src/metadata/normalize model.cpp may lead to arbitrary code execution, depending on the context. Recommendations: For versions prior ...

PT-2020-15485 · Jenkins · Jenkins Perfecto Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Perfecto Plugin versions 1.17 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials,...

OPENSUSE-SU-2020:1346-1 Security update for squid

This update for squid fixes the following issues: squid was updated to version 4.13: - CVE-2020-24606: Fix livelocking in peerDigestHandleReply bsc1175671. - CVE-2020-15811: Improve Transfer-Encoding handling bsc1175665. - CVE-2020-15810: Enforce token characters for field-name bsc1175664. This...

GHSA-V3JV-WRF4-5845 Local Privilege Escalation in npm

Affected versions of npm use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the npm process has permission to write t...

GHSA-GVG7-PP82-CFF3 Cross-Site Scripting in c3

Affected versions of c3 are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips. Recommendation Update to 0.4.11 or later...

DataTable Vulnerable to Cross-Site Scripting

Cross-site scripting XSS vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unittesting/templates/6776.php. Recommendation Update to a version greater than 1.10.8. A fix appears in...

OPENSUSE-SU-2020:1244-1 Security update for postgresql12

This update for postgresql12 fixes the following issues: - update to 12.4: CVE-2020-14349, bsc1175193: Set a secure searchpath in logical replication walsenders and apply workers CVE-2020-14350, bsc1175194: Make contrib modules' installation scripts more secure...

PT-2020-6067 · Unknown · Property-Expr

Name of the Vulnerable Software and Affected Versions: property-expr versions prior to 2.0.3 Description: The issue is related to Prototype Pollution via the setter function. It may allow a remote attacker to perform a prototype pollution attack by exploiting uncontrolled modification of object...

OPENSUSE-SU-2020:1199-1 Security update for wireshark

This update for wireshark fixes the following issues: - Wireshark to 3.2.5: CVE-2020-15466: GVCP dissector infinite loop bsc1173606 CVE-2020-13164: NFS dissector crash bsc1171899 CVE-2020-11647: The BACapp dissector could crash bsc1169063 - Further features, bug fixes and updated protocol support...

PT-2020-6146

Name of the Vulnerable Software and Affected Versions kramdown gem versions prior to 2.3.0 Description The issue exists due to the kramdown gem's failure to neutralize special elements, allowing a remote attacker to execute arbitrary code. This can lead to unintended read access or execution of...