UBUNTU-CVE-2021-3490

The eBPF ALU32 bounds tracking for bitwise ops AND, OR and XOR in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e "bpf: Fix...

SUSE: Security Advisory (SUSE-SU-2021:1268-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-FVRF-9428-527M Backport for CVE-2021-21024 Blind SQLi from Magento 2

Impact This vulnerability allows an administrator unauthorized access to restricted resources. We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html. Patches Has the...

Backport for CVE-2021-21024 Blind SQLi from Magento 2

Impact This vulnerability allows an administrator unauthorized access to restricted resources. We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html. Patches Has the...

GHSA-M496-X567-F98C Fixes a bug in Zend Framework's Stream HTTP Wrapper

Impact CVE-2021-3007: Backport of ZendHttpResponseStream, added certain type checking as a way to prevent exploitation. https://vulners.com/cve/CVE-2021-3007 This vulnerability is caused by the unsecured deserialization of an object. In versions higher than Zend Framework 3.0.0, the attacker abus...

CVE-2021-21427

Magento-lts is a long-term support alternative to Magento Community Edition CE. A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in...

CVE-2021-21427

Magento-lts is a long-term support alternative to Magento Community Edition CE. A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in...

CVE-2021-21427 Backport for CVE-2021-21024 Blind SQLi from Magento 2

Magento-lts is a long-term support alternative to Magento Community Edition CE. A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in...

java-11-openjdk security and bug fix update

1:11.0.11.0.9-1.0.1 - link atomic for ix86 build 1:11.0.11.0.9-1 - Add backport of JDK-8187450 from 11.0.12 to fix RH1937736 - Resolves: rhbz1937736 1:11.0.11.0.9-0 - Update to jdk-11.0.11.0+9 - Update release notes to 11.0.11.0+9 - Switch to GA mode for final release. - This tarball is embargoed...

SUSE-SU-2021:1250-1 Security update for xen

This update for xen fixes the following issues: - CVE-2021-27379: Fixed an issue where entries in the IOMMU were not being updated under certain circumstances due to improper backport of XSA-321 XSA-366, bsc1182431...

SUSE: Security Advisory (SUSE-SU-2015:1344-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

pki-core security and bug fix update

10.5.18-12 - Change variable 'TPS' to 'tps' - - RHEL 7.9: - - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates profiles, audit for IPA edewata - - Backported CVEs ascheel: - - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token parameters in TPS resulting in stored...

nodejs:12 security update

nodejs 1:12.21.0-1 - Resolves: RHBZ1932315, RHBZ1932424 - remove --debug-nghttp2 option - remove ini patch - Backport patch to use getauxval...

UBUNTU-CVE-2021-21309

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for...

CVE-2021-27379

A flaw was found in xen. An oversight was made when backporting XSA-320, leading to entries in the IOMMU not being properly updated under certain circumstances...

CVE-2021-27379

An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial of service host OS crash or gain privileges. This occurs because a backport missed a flush, and thus IOMMU updates were not always correct...

dracut bug fix and enhancement update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

CentOS 8 : fontforge (CESA-2020:4844)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:4844 advisory. - fontforge: SFDGetFontMetaData insufficient CVE-2020-5395 backport CVE-2020-25690 Note that Nessus has not tested for this issue but has instead relied only on...

sudo security update

1.8.6p3-29.0.2.el610.3 - backport the fix CVE-2021-3156.patch from ol7...

openSUSE Security Update : gcc7 (openSUSE-2020-2301)

This update for gcc7 fixes the following issues : - CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue bsc1172798 - Enable fortran for the nvptx offload compiler. - Update README.First-for.SuSE.packagers - avoid assembler errors with AVX512 gather and scatter instruction...