sudo: Heap buffer overflow in argument parsing

A flaw was found in sudo. A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is exploitable by any local user who can execute the sudo command by default, any local user can execute sudo without authentication. Successful exploitation of this flaw coul...

CVE-2020-4887

IBM AIX 7.1, 7.2 and AIX VIOS 3.1 could allow a local user to exploit a vulnerability in the gencore user command to create arbitrary files in any directory. IBM X-Force ID: 190911...

CVE-2020-25723

A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on t...

Security Bulletin: Multiple IBM DB2 Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt

Summary Multiple IBM DB2 Server security vulnerabilities affect IBM Emptoris Supplier Lifecycle Mgmt. Vulnerability Details CVEID: CVE-2020-4386 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitiv...

Linux kernel memory leak vulnerability (CNVD-2020-52395)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A memory leak vulnerability exists in the Linux Kernel's Ethernet driver. The vulnerability stems from a problem with...

CVE-2020-11519

The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to read or write to physical disc sectors via a \.\SecureDocDevice handle. Exploiting this vulnerability results in privileged code execution...

Unspecified Vulnerability in QuickBox

QuickBox is a media server application and service management system from the QuickBox team. The system supports the installation and management of applications using dashboards that enable users to interact with media servers. A security vulnerability exists in QuickBox Community Edition 2.5.5 a...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists as a flaw in the PPP over Ethernet implementation that allowed a remote user to cause a denial of service...

CVE-2020-8426

The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user...

CVE-2015-3147

The CVE-2015-3147 issue affects ABRT’s daemon, specifically daemon/abrt-handle-upload.in, where moving reports from /var/spool/abrt-upload can be manipulated via a symbolic link to write to arbitrary files (or cause other impacts) on the system. The vulnerability arises from a symlink attack agai...

CVE-2016-5346

An Information Disclosure vulnerability exists in the Google Pixel/Pixel SL Qualcomm Avtimer Driver due to a NULL pointer dereference when processing an accept system call by the user process on AFMSMIPC sockets, which could let a local malicious user obtain sensitive information Android Bug ID...

CVE-2010-3359

If LDLIBRARYPATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account...

CVE-2019-3731

RSA BSAFE Crypto-C Micro Edition versions prior to 4.1.4 and RSA Micro Edition Suite versions prior to 4.4 are vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of...

QEMU: pcnet: integer overflow leads to buffer overflow

An integer overflow issue was found in the AMD PC-Net II NIC emulation in QEMU. It could occur while receiving packets, if the size value was greater than INTMAX. Such overflow would lead to stack buffer overflow issue. A user inside guest could use this flaw to crash the QEMU process resulting i...

CVE-2019-15315

Valve Steam Client for Windows through 2019-08-16 allows privilege escalation to NT AUTHORITY\SYSTEM because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch...

Default credentials

cPanel before 82.0.2 allows local users to discover the MySQL root password SEC-510...

CVE-2019-12881

i915gemuserptrgetpages in drivers/gpu/drm/i915/i915gemuserptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cause a denial of service NULL pointer dereference and BUG or possibly have unspecified other impact via crafted ioctl calls to /dev/dri/card0...

CVE-2018-20509

The printbinderrefolocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by reading " ref desc node" lines in a debugfs file...

OPENSUSE-SU-2019:0065-1 Security update for the Linux Kernel

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-19407: The vcpuscanioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service NULL pointer dereference and BUG via crafted system call...

CVE-2019-6454

An issue was discovered in sd-bus in systemd 239. busprocessobject in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to...