Kernel update: Virtuozzo ReadyKernel patch 92.0 for Virtuozzo 7.0 and Virtuozzo Infrastructure Platform 2.5, 3.0

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to the kernels 3.10.0-693.21.1.vz7.48.2 Virtuozzo 7.0.7 HF3, 3.10.0-862.9.1.vz7.63.3 Virtuozzo 7.0.8, 3.10.0-862.11.6.vz7.64.7 Virtuozzo 7.0.8 HF1, 3.10.0-862.20.2.vz7.73.24 Virtuozzo 7.0.9 and Virtuozz...

CVE-2019-19221

In Libarchive 3.4.0, archivewstringappendfrommbs in archivestring.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive...

CVE-2015-3166

The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, a...

CVE-2015-3166

The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, a...

CVE-2015-3166

CVE-2015-3166 affects PostgreSQL; the snprintf implementation fails to properly handle errors from system calls, which can lead to information disclosure or other unspecified impact via out-of-memory scenarios. Affected versions include PostgreSQL releases before 9.0.20, 9.1.x before 9.1.16, 9.2....

CVE-2019-5542

VMware Workstation 15.x before 15.5.1 and Fusion 11.x before 11.5.1 contain a denial-of-service vulnerability in the RPC handler. Successful exploitation of this issue may allow attackers with normal user privileges to create a denial-of-service condition on their own VM...

Duplicate Advisory: Possible remote code execution via a remote procedure call

Withdrawn: duplicate of GHSA-pj4g-4488-wmxm Original Description In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings...

Google Android suffers from an unspecified vulnerability (CNVD-2020-03773)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Google Android has security vulnerabilities. An attacker can utilize the vulnerability to perform several activities, including recording videos, taking photos,...

Xiaomi Redmi Note 6 Pro Access Control Error Vulnerability

Xiaomi Redmi Note 6 Pro is a smartphone from Chinese company Xiaomi Technology Xiaomi. The Xiaomi Redmi Note 6 Pro build fingerprint: xiaomi/tulip/tulip:8.1.0/OPM1.171019.011/V10.2.2.0.OEKMIXM:user/release-keys contains a vulnerability in the com.qualcomm. qti.callenhancement app is vulnerable to...

Xiaomi Mi A2 Lite Access Control Error Vulnerability (CNVD-2019-41694)

Xiaomi Mi A2 Lite is a smartphone from Chinese company Xiaomi Technology Xiaomi. A security vulnerability exists in the Xiaomi Mi A2 Lite build fingerprint: xiaomi/daisy/daisysprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys in the com.qualcomm.qti A security vulnerability exists in th...

Xiaomi Mi A2 Lite Access Control Error Vulnerability

Xiaomi Mi A2 Lite is a smartphone from Chinese company Xiaomi Technology Xiaomi. A vulnerability in the Xiaomi Mi A2 Lite build fingerprint: xiaomi/jasmine/jasminesprout:9/PKQ1.180904.001/V10.0.2.0.PDIMIFJ:user/release-keys in the com.qualcomm An access control error vulnerability exists in the...

DEBIAN-CVE-2011-2910

The AX.25 daemon ax25d in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges but if the call fails the daemon would continue to run with root privileges which can allow possible privilege escalation...

CVE-2011-2910

The AX.25 daemon ax25d in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges but if the call fails the daemon would continue to run with root privileges which can allow possible privilege escalation...

Privilege escalation

The AX.25 daemon ax25d in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges but if the call fails the daemon would continue to run with root privileges which can allow possible privilege escalation...

CVE-2011-2910

The AX.25 daemon ax25d in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges but if the call fails the daemon would continue to run with root privileges which can allow possible privilege escalation...

Disabling SAML override in Confluence Data Center doesn't work

h3. Issue Summary Disabling SAML override in Confluence DC, to ensure no users can log in to Confluence via SAML/SSO only, still allows users to use default login URL and access the instance with local credentials. h3. Steps to Reproduce Configure Confluence DC with SAML/SSO steps not covered her...

CVE-2019-15472

The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisysprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app versionCode=28, versionName=9 that allows unauthorized microphon...

Input validation

The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/jasmine/jasminesprout:9/PKQ1.180904.001/V10.0.2.0.PDIMIFJ:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app versionCode=28, versionName=9 that allows unauthorized...

Design/Logic Flaw

The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisysprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app versionCode=28, versionName=9 that allows unauthorized microphon...

CVE-2019-15474

CVE-2019-15474 relates to the Xiaomi Cepheus Android device where a pre-installed app, com.qualcomm.qti.callenhancement, can be abused via a confused deputy attack. The app exposes an interface that lets any co-located app perform unauthorized microphone audio recording, saving recordings to exte...