SYS.2.3.A17

Die Nutzung von Systemaufrufen SOLLTE insbesondere fuer exponierte Dienste und Anwendungen auf die unbedingt notwendige Anzahl beschraenkt werden z. B. durch seccomp. Die vorhandenen Standardprofile bzw. -regeln von SELinux, AppArmor sowie alternativen Erweiterungen SOLLTEN manuell ueberprueft un...

NewStart CGSL CORE 5.04 / MAIN 5.04 : containerd.io Multiple Vulnerabilities (NS-SA-2021-0006)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has containerd.io packages installed that are affected by multiple vulnerabilities: - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because...

SYS.1.3.A10

Dienste und Anwendungen SOLLTEN mit einer individuellen Sicherheitsarchitektur geschuetzt werden z. B. mit AppArmor oder SELinux. Auch chroot-Umgebungen sowie LXC- oder Docker-Container SOLLTEN dabei beruecksichtigt werden. Es SOLLTE sichergestellt sein, dass mitgelieferte Standardprofile bzw...

SYS.1.3.A16

Die Nutzung von Systemaufrufen SOLLTE insbesondere fuer exponierte Dienste und Anwendungen auf die unbedingt notwendige Anzahl beschraenkt werden. Die Standardprofile bzw. -regeln von z. B. SELinux, AppArmor SOLLTEN manuell ueberprueft und unter Umstaenden an die eigenen Sicherheitsrichtlinien...

USN-4737-2: Bind vulnerability

USN-4737-1 fixed a vulnerability in Bind. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Bind incorrectly handled GSSAPI security policy negotiation. A remote attacker could use this issue to cause Bind to...

openSUSE Security Update : mumble (openSUSE-2021-300)

This update for mumble fixes the following issues : mumble was updated to 1.3.4 : - Fix use of outdated non-existent notification icon names - Fix Security vulnerability caused by allowing non http/https URL schemes in public server list boo1182123 - Server: Fix Exit status for actions like...

OPENSUSE-SU-2021:0312-1 Security update for mumble

This update for mumble fixes the following issues: mumble was updated to 1.3.4: Fix use of outdated non-existent notification icon names Fix Security vulnerability caused by allowing non http/https URL schemes in public server list boo1182123 Server: Fix Exit status for actions like --version or...

Security update for mumble (moderate)

openSUSE Security Update: Security update for mumble Announcement ID: openSUSE-SU-2021:0312-1 Rating: moderate References: 1180068 1182123 Affected Products: openSUSE Backports SLE-15-SP2 An update that contains security fixes can now be installed. Description: This update for mumble fixes the...

USN-4737-1: Bind vulnerability

It was discovered that Bind incorrectly handled GSSAPI security policy negotiation. A remote attacker could use this issue to cause Bind to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, attackers would be isolated by the Bind AppArmor...

USN-4737-1 bind9 vulnerability

It was discovered that Bind incorrectly handled GSSAPI security policy negotiation. A remote attacker could use this issue to cause Bind to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, attackers would be isolated by the Bind AppArmor...

OPENSUSE-SU-2021:0300-1 Security update for mumble

This update for mumble fixes the following issues: mumble was updated to 1.3.4: Fix use of outdated non-existent notification icon names Fix Security vulnerability caused by allowing non http/https URL schemes in public server list boo1182123 Server: Fix Exit status for actions like --version or...

Security update for mumble (moderate)

openSUSE Security Update: Security update for mumble Announcement ID: openSUSE-SU-2021:0300-1 Rating: moderate References: 1180068 1182123 Affected Products: openSUSE Leap 15.2 An update that contains security fixes can now be installed. Description: This update for mumble fixes the following...

EulerOS 2.0 SP9 : kata-containers (EulerOS-SA-2021-1245)

According to the version of the kata-containers package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3....

EulerOS 2.0 SP9 : kata-containers (EulerOS-SA-2021-1264)

According to the version of the kata-containers package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3....

CentOS 8 : container-tools:rhel8 (CESA-2019:4269)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:4269 advisory. - runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc CVE-2019-16884 - podman: resolving symlink in host filesystem lea...

Privilege Escalation

AppArmor is vulnerable to privilege escalation attacks. An unauthenticated attacker could have increased attack surfaces which would allow privilege escalation due to the use of common logic to handle 'restart' operations...

Oracle Linux 7 : docker-cli / docker-engine (ELSA-2020-5966)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5966 advisory. - Fix for CVE-2020-15257 - Fix for CVE-2020-15157 - Address CVE-2020-16845 - update to 19.03.11 for CVE-2020-13401 - apply...

CVE-2020-15257

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting...

CVE-2020-15257

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting...

DEBIAN-CVE-2020-15257

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting...