Amazon Linux AMI : curl (ALAS-2020-1444)

The version of curl installed on the remote host is prior to 7.61.1-12.95. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1444 advisory. A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple requests with libcurl's mul...

Amazon Linux AMI : poppler (ALAS-2020-1450)

The version of poppler installed on the remote host is prior to 0.26.5-43.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1450 advisory. A divide-by-zero error was found in the way Poppler handled certain PDF files. A remote attacker could exploit this flaw by...

Amazon Linux AMI : qemu-kvm (ALAS-2020-1449)

The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1449 advisory. qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service guest crash by leveraging...

Amazon Linux AMI : ruby24 (ALAS-2020-1451)

The version of ruby24 installed on the remote host is prior to 2.4.10-2.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1451 advisory. An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundle...

Amazon Linux AMI : samba (ALAS-2020-1452)

The version of samba installed on the remote host is prior to 4.10.16-5.54. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1452 advisory. All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with log...

Amazon Linux AMI : kernel (ALAS-2020-1446)

The version of kernel installed on the remote host is prior to 4.14.203-116.332. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1446 advisory. In binderreleasework of binder.c, there is a possible use-after-free due to improper locking. This could lead to...

Amazon Linux AMI : squid (ALAS-2020-1453)

The version of squid installed on the remote host is prior to 3.5.20-17.41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1453 advisory. An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive...

Multi-vendor BIOS Security Vulnerabilities (November 2020) - Lenovo Support US

No description provided...

NVIDIA Patches Critical Bug in High-Performance Servers

NVIDIA released a patch for a critical bug in its high-performance line of DGX servers that could open the door for a remote attacker to take control of and access sensitive data on systems typically operated by governments and Fortune-100 companies. In all, NVIDIA issued nine patches, each fixin...

CVE-2020-11486

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution...

Information disclosure

NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random Number Generator PRNG algorithm used in the JSOL package that implements the IPMI protocol is not cryptographically strong, which may lead to information...

Information disclosure

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain a vulnerability in the AMI BMC firmware in which default SNMP community strings are used, which may lead to information disclosure...

Design/Logic Flaw

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which software does not validate the RSA 1024 public key used to verify the firmware signature, which may lead t...

Information disclosure

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an attacker with administrative privileges can obtain the hash of the BMC/IPMI user password, which may lead to information disclosure...

CVE-2020-11615

NVIDIA DGX servers with AMI BMC firmware older than 3.38.30 are affected by CVE-2020-11615 due to a hard-coded RC4 cipher key in the AMI BMC firmware, which may lead to information disclosure. The NVIDIA security bulletin lists BMC firmware updates to 3.38.30 (and related DGX models) as the remed...

CVE-2020-11615

NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which it uses a hard-coded RC4 cipher key, which may lead to information disclosure...

CVE-2020-11616

CVE-2020-11616 affects NVIDIA DGX servers with BMC firmware versions prior to 3.38.30. The vulnerability arises from a weak PRNG in the JSOL IPMI package of the AMI BMC firmware, which could lead to information disclosure. Public documents identify the affected product class but do not provide ex...

CVE-2020-11488

CVE-2020-11488 affects NVIDIA DGX-1 and DGX-2 systems where the AMI BMC firmware before the stated versions does not validate the RSA-1024 public key used to verify firmware signatures, enabling potential information disclosure or code execution. Public details from NVIDIA/NVD indicate DGX-1 BMC ...

CVE-2020-11486

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution...

CVE-2020-11486

CVE-2020-11486 (NVIDIA DGX BMC): A vulnerability in the AMI Baseboard Management Controller (BMC) firmware on DGX-1 (and related DGX models) allows an attacker to upload or transfer files that can be automatically processed within the product’s environment, potentially enabling remote code execut...