Security fix for the ALT Linux 9 package node version 14.11.0-alt1

Sept. 16, 2020 Vitaly Lipatov 14.11.0-alt1 - new version 14.11.0 with rpmrb script - CVE-2020-8251: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests Critical - CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion High...

OSV-2020-1759 Index-out-of-bounds in LibRaw::ahd_interpolate_r_and_b_in_rgb_and_convert_to_cielab

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25652 Crash type: Index-out-of-bounds Crash state: LibRaw::ahdinterpolaterandbinrgbandconverttocielab LibRaw::ahdinterpolaterandbandconverttocielab LibRaw::ahdinterpolate...

Node.js -- September 2020 Security Releases

Node.js reports: Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues. HTTP Request Smuggling due to CR-to-Hyphen conversion High CVE-2020-8201 Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing...

libheif:color-conversion-fuzzer: Heap-buffer-overflow in Op_YCbCr_to_RGB<unsigned char>::convert_colorspace

Detailed Report: https://oss-fuzz.com/testcase?key=4811360620511232 Project: libheif Fuzzing Engine: honggfuzz Fuzz Target: color-conversion-fuzzer Job Type: honggfuzzasanlibheif Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x621000009d0f Crash State:...

CloudForms: Out-of-band OS Command Injection through conversion host

An out-of-band OS command injection vulnerability was found in Red Hat CloudForms. An authenticated malicious attacker could execute arbitrary commands on the server by sending a specially crafted request. The highest threat from this vulnerability is to data confidentiality and integrity as well...

CVE-2020-14324

A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker t...

CVE-2020-14324

A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker t...

Exploit for OS Command Injection in Paloaltonetworks Pan-Os

CVE-2020-2034-POC Determine the Version Running on the Palo Al...

OS Command Injection

cfme is vulnerable to OS command injection. An attacker is able to perform an out-of-band OS Command Injection through the conversion host...

UBUNTU-CVE-2020-12400

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox 80 and Firefox for Android 80...

OSV-2020-1532 Heap-buffer-overflow in Op_RGB_to_RGB24_32::convert_colorspace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22109 Crash type: Heap-buffer-overflow READ 1 Crash state: OpRGBtoRGB2432::convertcolorspace heif::ColorConversionPipeline::convertimage heif::convertcolorspace...

OSV-2020-1531 Segv on unknown address in clang::Sema::PerformImplicitConversion

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19621 Crash type: Segv on unknown address Crash state: clang::Sema::PerformImplicitConversion clang::Sema::PerformImplicitConversion clang::Sema::PerformContextuallyConvertToBool...

Important: Red Hat Security Advisory: Container-native Virtualization security, bug fix, and enhancement update

Red Hat OpenShift Virtualization release 2.4.0 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which giv...

OSV-2020-1503 Use-of-uninitialized-value in clip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22181 Crash type: Use-of-uninitialized-value Crash state: clip OpYCbCr420toRGB8bit::convertcolorspace heif::ColorConversionPipeline::convertimage...

Product update: Virtuozzo 6.0 Update 12 Hotfix 53 (6.0.12-3760)

This update provides a stability fix. Vulnerability id: PSBM-104691 Disk space consumption could grow unconditionally during vzfs to ploop conversion...

SUSE-SU-2020:1937-1 Security update for cairo

This update for cairo fixes the following issues: - Fix a memory corruption in pango. - Revert 'Correctly decode Adobe CMYK JPEGs in PDF export'. - Add more FreeeType font color conversions to support COLR/CPAL. - Fix crash when rendering Microsoft's Segoe UI Emoji Regular font. - Fix memory leak...

Converting MBOX to Outlook Easily

Mail transfer is a common search query. Most commonly, users may migrate due to personal preferences, corporate policies, or support issues. Systems based on the MBOX format are tricky: you may easily export the files, but direct import to Outlook is impossible. That is unless you use the right...

SUSE-SU-2019:3184-2 Security update for ffmpeg

This update for ffmpeg fixes the following issues: Security issues fixed: - CVE-2019-17542: Fixed a heap-buffer overflow in vqadecodechunk due to an out-of-array access bsc1154064. - CVE-2019-12730: Fixed an uninitialized use of variables due to an improper check bsc1137526. - CVE-2019-9718: Fixe...

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to data conversion flaws, allowing attackers to execute arbitrary code.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to data conversion deficiencies. Exploiting these vulnerabilities can allow attacker...

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to data conversion flaws, allowing attackers to execute arbitrary code.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to data conversion deficiencies. Exploiting these vulnerabilities can allow attacker...