DEBIAN-CVE-2020-7720

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions...

Prototype Pollution

Overview node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities. Affected versions of this package are vulnerable to Prototype Pollution via the util.setPath function. Note: version 0.10.0 is a breaking change removing...

util-linux:test_fdisk_script_fuzz: Heap-buffer-overflow in fdisk_partname

Project: https://github.com/karelzak/util-linux.git Detailed Report: https://oss-fuzz.com/testcase?key=5705475858104320 Project: util-linux Fuzzing Engine: libFuzzer Fuzz Target: testfdiskscriptfuzz Job Type: libfuzzerasani386util-linux Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

GNU GLOBAL: Arbitrary code execution

Background GNU GLOBAL is a source code tagging system that works the same way across diverse environments, such as Emacs editor, Vi editor, Less viewer, Bash shell, various web browsers, etc. Description A vulnerability was found in an undocumented function of gozilla. Impact A remote attacker...

Security Bulletin: Nss,Nss-util and Nspr vulnerabilities affect IBM SmartCloud Entry (CVE-2016-1978, CVE-2016-1979 )

Summary IBM SmartCloud Entry is vulnerable to multiple vulnerabilities in nss, nss-util and nspr. Attackers could exloit them using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. Vulnerability Details CVEID: CVE-2016-1978 DESCRIPTION: Mozil...

Security Bulletin: Multiple vulnerabilities in coreutils, sudo, jasper, bind, bash, libtirpc, nss and nss-util affect IBM SmartCloud Entry

Summary Multiple vulnerabilities have been identified in coreutils, sudo, jasper, bind, bash, libtirpc, nss and nss-util. coreutils, sudo, jasper, bind, bash, libtirpc, nss and nss-util shipped with IBM SmartCloud Entry Appliance. IBM SmartCloud Entry Appliance has addressed the vulnerabilities...

Security Bulletin: Nss-util vulnerabilities affect IBM SmartCloud Entry( CVE-2016-1950 )

Summary IBM SmartCloud Entry is vulnerable to a nss-tuil vulnerability, attackers could exploit it to cause the application to crash. Vulnerability Details CVEID: CVE-2016-1950 DESCRIPTION: Mozilla Firefox is vulnerable to a heap-based buffer overflow, caused by improper bounds checking when the...

Huawei EulerOS: Security Advisory for util-linux (EulerOS-SA-2020-1715)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 3.0.6.0 : util-linux (EulerOS-SA-2020-1715)

According to the version of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service crash...

OSV-2020-104 Heap-buffer-overflow in void arrow::util::internal::ByteStreamSlitDecodeSSE2<double>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21420 Crash type: Heap-buffer-overflow READ 1 Crash state: void arrow::util::internal::ByteStreamSlitDecodeSSE2 virtual thunk to parquet::ByteStreamSplitDecoderparquet::PhysicalType parquet::TypedDecoderparquet::PhysicalType...

Design/Logic Flaw

Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOSLOCALSECRET value, affecting password resets and invitations...

EulerOS 2.0 SP2 : apr-util (EulerOS-SA-2020-1639)

According to the version of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of...

EulerOS 2.0 SP2 : util-linux (EulerOS-SA-2020-1620)

According to the version of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the...

Huawei EulerOS: Security Advisory for util-linux (EulerOS-SA-2020-1620)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for apr-util (EulerOS-SA-2020-1639)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

airflow-util-dv (>=1.2.1 <=1.6.2), dbnd-examples (>=0.50.1 <=0.56.7) +2 more potentially affected by CVE-2020-11981 via apache-airflow (>=1.10.1 <=1.10.10)

apache-airflow PYPI version =1.10.1, =1.2.1, =0.50.1, =0.0.1, =10.3.0rc1, =10.3.0rc2 Source cves: CVE-2020-11981 Source advisory: SNYK:PYTHON-APACHEAIRFLOW-570291...

CVE-2020-13388

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safeload is not used...

PYSEC-2020-341

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safeload is not used...

PT-2020-4065 · Jw · Jw.Util

Name of the Vulnerable Software and Affected Versions: jw.util versions prior to 2.3 Description: The issue is related to errors in processing YAML files when loading configuration, allowing a remote attacker to execute arbitrary operating system commands. This is due to the lack of safe load whe...

SUSE SLES12 Security Update : libvirt (SUSE-SU-2020:1289-1)

This update for libvirt fixes the following issues : Security issue fixed : CVE-2020-10703: Fixed a daemon crash caused by pools without target paths bsc1168683. Non-security issues fixed : apparmor: avoid copying empty profile name bsc1149100. logging: ensure virtlogd rollover takes priority ove...