Low: Red Hat Security Advisory: OpenShift Virtualization 2.4.2 Images

Red Hat OpenShift Virtualization release 2.4.2 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a...

[SECURITY] Fedora 31 Update: pandoc-2.5-2.fc31

Pandoc is a Haskell library for converting from one markup format to anothe r, and a command-line tool that uses this library. It can read several dialect s of Markdown and subsets of HTML, reStructuredText, LaTeX, DocBook, JATS, MediaWiki markup, TWiki markup, TikiWiki markup, Creole 1.0, Haddoc...

[SECURITY] Fedora 31 Update: gitit-0.12.3.2-4.fc31

Gitit is a wiki backed by a git, darcs, or mercurial filestore. Pages and uploaded files can be modified either directly via the VCS's command-line t ools or through the wiki's web interface. Pandoc is used for markup processing, so pages may be written in extended markdown, reStructuredText,...

audiofile security update

1:0.3.6-9 - Apply security patches. CVE-2018-17095, CVE-2018-13440 - Resolves: rhbz1600369, rhbz1601014, rhbz1637128 1:0.3.6-8 - Escape macros in %changelog 1:0.3.6-7 - Merge upstream pull requests 42,43,44 from Agostino Sarubbo to fix security issues. CVE-2017-6827, CVE-2017-6828, CVE-2017-6829,...

samba: Crash after failed character conversion at log level 3 or above

A flaw was found in samba. When log levels are set at 3 or higher, the string obtained from the client, after a failed character conversion, is printed which could cause long-lived processes to terminate. The highest threat from this vulnerability is to system availability...

[SECURITY] Fedora 33 Update: pandoc-2.9.2.1-8.fc33

Pandoc is a Haskell library for converting from one markup format to anothe r, and a command-line tool that uses this library. It can read several dialect s of Markdown and subsets of HTML, reStructuredText, LaTeX, DocBook, JATS, MediaWiki markup, DokuWiki markup, TWiki markup, TikiWiki markup,...

Vulnerabilities of operating systems such as iOS, iPadOS, tvOS, watchOS, Safari browser, and the multimedia player iTunes for Windows operating systems, as well as the iCloud service for Windows operating systems, are related to data type conversion errors, allowing attackers to execute arbitrary code.

Vulnerabilities of operating systems such as iOS, iPadOS, tvOS, watchOS, Safari browser, and the multimedia player iTunes for Windows operating systems, as well as the iCloud service for Windows operating systems, are related to data type conversion errors. Exploiting these vulnerabilities can...

RHEL 7 : samba (RHSA-2020:3981)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3981 advisory. Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol, which allo...

GHSA-X7GM-RFGV-W973 Potential DoS with NumberFilter conversion to integer values.

Impact Automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Patches Version 2.4.0+ applies a MaxValueValidator with a a default limitvalue of...

EulerOS 2.0 SP3 : samba (EulerOS-SA-2020-2110)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way...

EulerOS 2.0 SP3 : nettle (EulerOS-SA-2020-2069)

According to the version of the nettle packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS1 v1.5...

Security Bulletin: IBM MQ is vulnerable to a denial of service attack due to an error within the Data Conversion logic. (CVE-2020-4310)

Summary An issue was found within the data conversion logic that could cause a SIGSEGV and denial of service within an MQ channel process. Vulnerability Details CVEID: CVE-2020-4310 DESCRIPTION: IBM MQ and MQ Appliance is vulnerable to a denial of service attack due to an error within the Data...

Arbitrary Code Execution

SQLite is vulnerable to arbitrary code execution. A stack-based buffer overflow and integer overflow in the sqlite3VXPrintf function in printf.c allows an attacker to execute arbitrary code on the host OS due to improperly handling of precision and width values during floating-point conversions...

The vulnerabilities of Adobe Acrobat and Adobe Reader PDF viewer/editor programs, related to data conversion errors, allow attackers to execute arbitrary code.

The vulnerability of Adobe Acrobat and Adobe Reader PDF viewer/editor programs is related to data conversion errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created HTML file...

The vulnerabilities of Adobe Acrobat and Adobe Reader PDF viewer/editor programs, related to data conversion errors, allow attackers to execute arbitrary code.

The vulnerability of Adobe Acrobat and Adobe Reader PDF viewer/editor programs is related to data conversion errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created HTML file...

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to data conversion errors, allowing attackers to execute arbitrary code.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to data type conversion errors. Exploiting these vulnerabilities can allow an attack...

Security fix for the ALT Linux 10 package node version 14.11.0-alt1

Sept. 16, 2020 Vitaly Lipatov 14.11.0-alt1 - new version 14.11.0 with rpmrb script - CVE-2020-8251: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests Critical - CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion High...

Security fix for the ALT Linux 9 package node version 14.11.0-alt1

Sept. 16, 2020 Vitaly Lipatov 14.11.0-alt1 - new version 14.11.0 with rpmrb script - CVE-2020-8251: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests Critical - CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion High...

OSV-2020-1759 Index-out-of-bounds in LibRaw::ahd_interpolate_r_and_b_in_rgb_and_convert_to_cielab

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25652 Crash type: Index-out-of-bounds Crash state: LibRaw::ahdinterpolaterandbinrgbandconverttocielab LibRaw::ahdinterpolaterandbandconverttocielab LibRaw::ahdinterpolate...

Node.js -- September 2020 Security Releases

Node.js reports: Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues. HTTP Request Smuggling due to CR-to-Hyphen conversion High CVE-2020-8201 Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing...