OPENSUSE-SU-2020:0952-1 Security update for nasm

This update for nasm fixes the following issues: nasm was updated to version 2.14.02. This allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes and improvements. Fix crash due to multiple errors or warnings during the code generation pass if a list file is...

OPENSUSE-SU-2020:0950-1 Security update for opera

This update for opera fixes the following issues: - Update to version 69.0.3686.49 - CHR-7971 Update chromium on desktop-stable-83-3686 to 83.0.4103.116 CVE-2020-6509 - DNA-79195 Wrong date on history - DNA-86090 Crash at views::View::ReorderChildViewviews::View, int - DNA-86122 Mac Some popovers...

MGASA-2020-0276 Updated mailman packages fix security vulnerability

Updated mailman package fixes security vulnerability: Up to mailman 2.1.29 when sending a file without a file extension or an unknown file extension then the file is stored in the list archive with the file extension .obj. Most web servers will try to assign a mime type based on the file extensio...

PT-2020-6205 · Ilm +4 · Openexr +4

Name of the Vulnerable Software and Affected Versions: OpenEXR versions prior to 2.5.2 Description: The issue is related to a heap buffer overflow in the getChunkOffsetTableSize function in IlmImf/ImfMisc.cpp. This overflow can occur due to invalid chunkCount attributes. The exploitation of this...

PT-2020-14075 · Freedroidrpg Team +1 · Freedroidrpg +1

Name of the Vulnerable Software and Affected Versions: FreedroidRPG version 1.0rc2 Description: An issue exists in the map.c file of FreedroidRPG version 1.0rc2. The software assumes lengths of data sets read from saved game files and copies data from a file into a fixed-size heap-allocated buffe...

PT-2020-12301

Name of the Vulnerable Software and Affected Versions Ceph versions 15.2.0 through 15.2.1 Description An authorization bypass issue was found in the ceph-mon and ceph-mgr daemons, where they do not properly restrict access. This allows an authenticated client to gain access to unauthorized...

PT-2020-8463

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered related to weak hashing used for e-mail invitations, OAuth, and e-mail...

SUSE SLES15 Security Update : freetds (SUSE-SU-2020:1417-1)

This update for freetds to 1.1.36 fixes the following issues : Security issue fixed : CVE-2019-13508: Fixed a heap overflow that could have been caused by malicious servers sending UDT types over protocol version 5.0 bsc1141132. Non-security issues fixed : Enabled Kerberos support Version update ...

PT-2021-6018

Name of the Vulnerable Software and Affected Versions urllib3 versions prior to 1.26.5 Description The issue is related to an HTTP client vulnerability in Python urllib3, which is associated with uncontrolled resource consumption. Exploitation of the vulnerability may allow a remote attacker to...

SUSE-SU-2020:1524-1 Security update for python

This update for python to version 2.7.17 fixes the following issues: Syncing with lots of upstream bug fixes and security fixes. Bug fixes: - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs bsc1162825. - CVE-2019-18348: Fixed a CRLF injection via the host part of the...

PT-2020-13657 · Sabberworm +2 · Sabberworm Php Css Parser +2

Name of the Vulnerable Software and Affected Versions: Sabberworm PHP CSS Parser versions prior to 8.3.1 php-horde-css-parser version 1.0.8-1ubuntu1+esm1 and earlier Description: The issue is related to the parsing of uncontrolled CSS data, which could lead to remote code execution. The functions...

PT-2020-4257 · Google · Google Chrome

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 83.0.4103.88 Description: The issue is related to an incorrect implementation in the user interface of Google Chrome on iOS, allowing a remote attacker to perform domain spoofing via a crafted HTML page. This c...

PT-2020-19691

Name of the Vulnerable Software and Affected Versions websocket-extensions ruby module versions prior to 0.1.5 Description The issue allows for Denial of Service DoS via Regex Backtracking. An attacker can exploit this by providing a malicious payload with the Sec-WebSocket-Extensions header,...

openSUSE Security Update : freetds (openSUSE-2020-741)

This update for freetds to 1.1.36 fixes the following issues : Security issue fixed : - CVE-2019-13508: Fixed a heap overflow that could have been caused by malicious servers sending UDT types over protocol version 5.0 bsc1141132. Non-security issues fixed : - Enabled Kerberos support - Version...

Moderate: Red Hat Enhancement Advisory: rh-varnish6 bug fix and enhancement update

Updated rh-varnish6 packages are now available as a part of Red Hat Software Collections for Red Hat Enterprise Linux. Varnish Cache is a high-performance HTTP reverse proxy. The rh-varnish6 packages provide a recent stable release of Varnish Cache 6. The rh-varnish6 packages have been upgraded t...

PT-2020-5645 · Ruby +3 · Ruby On Rails +3

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions prior to 5.2.4.3 Ruby on Rails versions prior to 6.0.3.1 Description: The issue is related to the deserialization of untrusted data in the MemCacheStore and RedisCacheStore components of Ruby on Rails. This can allow an...

PT-2020-5647 · Ruby +5 · Rack +5

Name of the Vulnerable Software and Affected Versions: rack versions prior to 2.2.0 Description: A directory traversal issue exists in the Rack::Directory app, allowing an attacker to perform a directory traversal attack, which could result in information disclosure. The vulnerability is related ...

Updated samba packages fix security vulnerabilities

Updated samba packages fix security vulnerabilities: A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a use-after-free in Samba's AD DC LDAP server CVE-2020-10700. A deeply nested filter in an un-authenticated LDAP search can exhaust the LDAP server's stack memory causing ...

MGASA-2020-0205 Updated samba packages fix security vulnerabilities

Updated samba packages fix security vulnerabilities: A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a use-after-free in Samba's AD DC LDAP server CVE-2020-10700. A deeply nested filter in an un-authenticated LDAP search can exhaust the LDAP server's stack memory causing ...

PT-2020-13206 · Openstack +1 · Openstack Keystone +1

Name of the Vulnerable Software and Affected Versions: OpenStack Keystone versions prior to 15.0.1 OpenStack Keystone version 16.0.0 Description: An issue allows any user authenticated within a limited scope to create an EC2 credential with escalated permission, such as obtaining admin while the...