PT-2021-2458

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 5.11.10 Description An issue in the Freescale Gianfar Ethernet driver allows attackers to cause a system crash due to a negative fragment size calculation when jumbo packets are used and NAPI is enabled,...

CVE-2021-20233

A flaw was found in grub2 in versions prior to 2.06. Setparamprefix in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one...

CVE-2021-20233

A flaw was found in grub2 in versions prior to 2.06. Setparamprefix in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one...

Debian DSA-4867-1 : grub2 - security update

Several vulnerabilities have been discovered in the GRUB2 bootloader. - CVE-2020-14372 It was discovered that the acpi command allows a privileged user to load crafted ACPI tables when Secure Boot is enabled. - CVE-2020-25632 A use-after-free vulnerability was found in the rmmod command. -...

SUSE SLES12 Security Update : grub2 (SUSE-SU-2021:0682-1)

This update for grub2 fixes the following issues : grub2 now implements the new 'SBAT' method for SHIM based secure boot revocation. bsc1182057 Following security issues are fixed that can violate secure boot constraints : CVE-2020-25632: Fixed a use-after-free in rmmod command bsc1176711...

grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

A flaw was found in grub2. Setparamprefix in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in th...

[ASA-202102-36] python-cryptography: incorrect calculation

Arch Linux Security Advisory ASA-202102-36 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2020-36242 Package : python-cryptography Type : incorrect calculation Remote : No Link : https://security.archlinux.org/AVG-1541 Summary ======= The package...

[ASA-202102-42] openssl: multiple issues

Arch Linux Security Advisory ASA-202102-42 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2021-23840 CVE-2021-23841 Package : openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1581 Summary ======= The package openssl...

PT-2021-30924

Уязвимость файлового менеджера fly-fm связана с некорректным вычислением MD5 в окне программы. Эксплуатация уязвимости позволяет нарушителю, действующему удаленно, вызвать отказ в обслуживании...

[ASA-202102-6] chromium: multiple issues

Arch Linux Security Advisory ASA-202102-6 ========================================= Severity: Critical Date : 2021-02-06 CVE-ID : CVE-2021-21142 CVE-2021-21143 CVE-2021-21144 CVE-2021-21145 CVE-2021-21146 CVE-2021-21147 CVE-2021-21148 Package : chromium Type : multiple issues Remote : Yes Link :...

CentOS 8 : thunderbird (CESA-2020:0577)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:0577 advisory. - Mozilla: Message ID calculation was based on uninitialized data CVE-2020-6792 - Mozilla: Out-of-bounds read when processing certain email messages...

CVE-2021-3114: Incorrect Calculation

In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field...

OpenLDAP Denial of Service Vulnerability (CNVD-2021-07934)

OpenLDAP is a free, open source implementation of the Lightweight Directory Access Protocol LDAP. A denial of service vulnerability exists in OpenLDAP versions prior to 2.4.57. An attacker could exploit this vulnerability to cause a memch-bvlen calculation error and a slapd crash in saslAuthzTo...

[ASA-202101-27] go: multiple issues

Arch Linux Security Advisory ASA-202101-27 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2021-3114 CVE-2021-3115 Package : go Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1481 Summary ======= The package go before versio...

[ASA-202101-41] jenkins: multiple issues

Arch Linux Security Advisory ASA-202101-41 ========================================== Severity: High Date : 2021-01-20 CVE-ID : CVE-2021-21602 CVE-2021-21603 CVE-2021-21604 CVE-2021-21605 CVE-2021-21606 CVE-2021-21607 CVE-2021-21608 CVE-2021-21609 CVE-2021-21610 CVE-2021-21611 Package : jenkins...

CVE-2021-3004: Incorrect Calculation

The deposit function in the smart contract implementation for Stable Yield Credit yCREDIT, an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should...

Blizmax Flamingoim Path Traversal Vulnerability

Blizmax Flamingoim is a high-performance, lightweight, open source instant messaging software from the individual developers at Blizmax. A path traversal vulnerability exists in Blizmax Flamingoim version 2020-09-29 and earlier, which stems from the fact that the only ostensibly unpredictable par...

Imagemagick Studio ImageMagick Input Validation Error Vulnerability (CNVD-2021-23800)

Imagemagick Studio ImageMagick is a suite of open source image processing software from ImageMagick Studio Imagemagick Studio, an American company. The software can read, convert or write images in many formats. A security vulnerability exists in ImageMagick versions prior to 7.0.8-68, which stem...

CVE-2020-17440

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that domain names present in the DNS responses have '\0' termination. This results in errors when calculating the offset of the pointer that jumps over domain...

CVE-2020-17440

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that domain names present in the DNS responses have '\0' termination. This results in errors when calculating the offset of the pointer that jumps over domain...