SUSE-SU-2020:0649-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12-SP4 kernel-RT was updated to 4.12.14 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-8992: Fixed an issue in ext4protectreservedinode in fs/ext4/blockvalidity.c that allowed attackers to cause a soft lockup via a crafted...

Mozilla Firefox Security Advisories (MFSA2020-08, MFSA2020-09) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Mozilla Firefox Security Advisories (MFSA2020-08, MFSA2020-09) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Mozilla Firefox ESR Security Advisories (MFSA2020-08, MFSA2020-09) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

UBUNTU-CVE-2020-6815

Mozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evidence of memory corruption or escalation of privilege and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affec...

NewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0022)

The remote NewStart CGSL host, running version MAIN 4.05, has thunderbird packages installed that are affected by multiple vulnerabilities: - Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent proces...

CVE-2020-6815

Mozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evidence of memory corruption or escalation of privilege and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affec...

Microsoft Patch Tuesday, March 2020 Edition

Microsoft Corp. today released updates to plug more than 100 security holes in its various Windows operating systems and associated software. If you abuse Windows, please take a moment to read this post, backup your systems, and patch your PCs. All told, this patch batch addresses at least 115...

Microsoft Patches 26 Critical Bugs in Big March Update

Microsoft tackled 115 bug fixes as part of its March Patch Tuesday update – 26 rated critical and 88 rated medium severity. The bugs patched span its product catalog, from Azure DevOps to Windows 10. This month’s haul is notable in its quantity and that there are only a few stand-out bugs causing...

CVE-2020-5259

In affected versions of dojox NPM package, the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or...

Firefox Bug Opens iPhone AirPods to Third-Party Snooping

Five high-severity bugs were fixed in the Firefox web browser with the release of version 74 by the Mozilla Foundation on Tuesday. In addition, Mozilla reported a quirky moderate-severity flaw that allows hackers to target iPhone users and collect data tied to connected AirPods, if in use. In...

Firefox Bug Opens iPhone AirPods to Third-Party Snooping

Five high-severity bugs were fixed in the Firefox web browser with the release of version 74 by the Mozilla Foundation on Tuesday. In addition, Mozilla reported a quirky moderate-severity flaw that allows hackers to target iPhone users and collect data tied to connected AirPods, if in use. In...

Security Vulnerabilities fixed in Thunderbird 68.6 — Mozilla

When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during scrip...

Security fix for the ALT Linux 10 package firefox-esr version 68.6.0-alt1

March 10, 2020 Andrey Cherepanov 68.6.0-alt1 - New ESR version 68.6.0. - Fix license tag according to SPDX. - Fixed: + CVE-2020-6805 Use-after-free when removing data about origins + CVE-2020-6806 BodyStream::OnInputStreamReady was missing protections against state confusion + CVE-2020-6807...

MGASA-2020-0132 Updated gcc packages fix security vulnerability

This update provides gcc 8.4.0 stable release, containing important fixes for regressions and serious bugs in GCC 8.3 with more than 209 bugs fixed since the previous release. It also fixes at least the following security issue: every time the collect2 process is interrupted via a signal it can...

CVE-2019-20503

usrsctp before 2019-12-20 has out-of-bounds reads in sctploadaddressesfrominit...

Updated php packages fix bugs and security vulnerabilities

Updated php packages fix bugs and security vulnerabilities: Core: - Fixed bug 71876 Memory corruption htmlspecialchars: charset ' not supported. - Fixed bug 79146 cscript can fail to run on some systems. - Fixed bug 78323 Code 0 is returned on invalid options. - Fixed bug 76047 Use-after-free...

Updated pcre packages fix security vulnerability

Updated pcre packages fix security vulnerabilities: The pcre package has been updated to version 8.44, fixing an integer overflow and NULL pointer dereference, as well as other bugs. See the upstream changelog for details...

Security Bulletin: Multiple vulnerabilities of Mozzila Firefox (less than Firefox 68.4 ESR) have affected Synthetic Playback Agent 8.1.4.0 - 8.1.4 IF10 + ICAM 3.0 - 4.0

Summary Synthetic Playback Agent has addressed the following vulnerabilities: CVE-2019-17017, CVE-2019-17022, CVE-2019-17024 Vulnerability Details CVEID: CVE-2019-17022 DESCRIPTION: Mozilla Firefox is vulnerable to cross-site scripting, caused by the failure of the CSS sanitization to escape HTML...

SUSE SLES12 Security Update : kernel (SUSE-SU-2020:0584-1)

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-2732: Fixed an issue affecting Intel CPUs where an L2 guest may trick the L0 hypervisor into accessing sensitive L1 resources bsc1163971. CVE-2019-19338:...