GHSA-6898-WX94-8JQ8 Potential Command Injection in libnotify

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify. Untrusted input passed in the call to libnotify.notify could result in execution of shell...

Vulnerability in Platform Mechanism AutoIP

SICK received a report from IOActive that informed SICK about a security vulnerability within the platform mechanism AutoIP, used by multiple devices. SICK recommends updating to the newest version. Refer to the recommended remediations for affected products where no update is available. Currentl...

Updated kernel and kernel-linus packages fix security vulnerabilities

This update is based on the upstream 5.7.19 kernel and fixes at least the following security issue: In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in trymergefreespace ...

Multiple cross-site scripting vulnerabilities in Exment

Overview Exment provided by Kajitori Co.,Ltd contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in some input fields CWE-79 - CVE-2020-5619 Stored cross-site scripting vulnerability in upload files CWE-79 - CVE-2020-5620 Ryoya Koyama of...

MGASA-2020-0338 Updated freerdp packages fix security vulnerability

Integer overflow due to missing input sanitation in rdpegfx channel. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on invalid length arguments to a memcpy CVE-2020-1510...

MGASA-2020-0317 Updated webkit2 packages fix security vulnerability

Updated webkit2 packages fix security vulnerabilities: The webkit2 package has been updated to version 2.28.3, fixing several security issues and other bugs...

PT-2020-5548 · Artifex +7 · Ghostscript +7

Name of the Vulnerable Software and Affected Versions: Artifex Software GhostScript versions 9.50 Description: A buffer overflow issue in the mj raster cmd function allows a remote attacker to cause a denial of service via a crafted PDF file. Recommendations: For Artifex Software GhostScript...

Critical: Red Hat Security Advisory: chromium-browser security update

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

PT-2020-5809 · Google +8 · Brotli Library +8

Name of the Vulnerable Software and Affected Versions: Brotli library versions prior to 1.0.8 Description: A buffer overflow exists in the Brotli library where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copyin...

Low: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.31 packages update

Red Hat OpenShift Container Platform release 4.3.31 is now available with updates to packages and images that fix several bugs. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This...

PT-2020-3621 · Gnu +7 · Grub2 +7

Name of the Vulnerable Software and Affected Versions: Grub2 versions prior to 2.06 Description: The issue is related to an integer overflow of the UINT32 value, which can allow an attacker to access confidential data, compromise its integrity, and cause a denial of service. Specifically, the...

OPENSUSE-SU-2020:1074-1 Security update for salt

This update for salt contains the following fixes: - Fix for TypeError in Tornado importer bsc1174165 - Require python3-distro only for TW bsc1173072 - Update to Salt version 3000: See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html - Add docker.logout to docker...

OPENSUSE-SU-2020:0952-1 Security update for nasm

This update for nasm fixes the following issues: nasm was updated to version 2.14.02. This allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes and improvements. Fix crash due to multiple errors or warnings during the code generation pass if a list file is...

OPENSUSE-SU-2020:0950-1 Security update for opera

This update for opera fixes the following issues: - Update to version 69.0.3686.49 - CHR-7971 Update chromium on desktop-stable-83-3686 to 83.0.4103.116 CVE-2020-6509 - DNA-79195 Wrong date on history - DNA-86090 Crash at views::View::ReorderChildViewviews::View, int - DNA-86122 Mac Some popovers...

MGASA-2020-0276 Updated mailman packages fix security vulnerability

Updated mailman package fixes security vulnerability: Up to mailman 2.1.29 when sending a file without a file extension or an unknown file extension then the file is stored in the list archive with the file extension .obj. Most web servers will try to assign a mime type based on the file extensio...

PT-2020-6205 · Ilm +4 · Openexr +4

Name of the Vulnerable Software and Affected Versions: OpenEXR versions prior to 2.5.2 Description: The issue is related to a heap buffer overflow in the getChunkOffsetTableSize function in IlmImf/ImfMisc.cpp. This overflow can occur due to invalid chunkCount attributes. The exploitation of this...

PT-2020-14075 · Freedroidrpg Team +1 · Freedroidrpg +1

Name of the Vulnerable Software and Affected Versions: FreedroidRPG version 1.0rc2 Description: An issue exists in the map.c file of FreedroidRPG version 1.0rc2. The software assumes lengths of data sets read from saved game files and copies data from a file into a fixed-size heap-allocated buffe...

PT-2020-12301

Name of the Vulnerable Software and Affected Versions Ceph versions 15.2.0 through 15.2.1 Description An authorization bypass issue was found in the ceph-mon and ceph-mgr daemons, where they do not properly restrict access. This allows an authenticated client to gain access to unauthorized...

PT-2020-8463

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered related to weak hashing used for e-mail invitations, OAuth, and e-mail...

SUSE SLES15 Security Update : freetds (SUSE-SU-2020:1417-1)

This update for freetds to 1.1.36 fixes the following issues : Security issue fixed : CVE-2019-13508: Fixed a heap overflow that could have been caused by malicious servers sending UDT types over protocol version 5.0 bsc1141132. Non-security issues fixed : Enabled Kerberos support Version update ...