[SECURITY] Fedora 31 Update: fastd-21-1.fc31

fastd is a secure tunneling daemon with some unique features: - Very small binary about 100KB on OpenWRT in the default configuration, including all dependencies besides libc - Exchangable crypto methods - Transport over UDP for simple usage behind NAT - Can run in 1:1 and 1:n scenarios - There a...

EulerOS 2.0 SP2 : ntp (EulerOS-SA-2020-2374)

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging a...

EulerOS 2.0 SP2 : compat-openldap (EulerOS-SA-2020-2334)

According to the version of the compat-openldap package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service daemon...

EulerOS 2.0 SP2 : trousers (EulerOS-SA-2020-2402)

According to the versions of the trousers package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to...

EulerOS 2.0 SP5 : trousers (EulerOS-SA-2020-2301)

According to the versions of the trousers package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to...

Fedora: Security Advisory for xen (FEDORA-2020-e3d619cc32)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the service for managing access to remote catalogs and authentication mechanisms, related to deficiencies in access control, allows attackers to disclose protected information and compromise its integrity.

The vulnerability of the service for managing access to remote catalogs and the authentication mechanism sssd is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose protected information and compromise its integri...

Low: avahi

Issue Overview: avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service traffic amplification and may cause information leakage by obtaining potentially...

Amazon Linux 2 : avahi (ALAS-2020-1502)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1502 advisory. avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not...

Debian DLA-2414-1 : fastd security update

In fastd, a fast and secure tunnelling daemon, a receive buffer handling problem was discovered which allows a denial of service memory exhaustion when receiving packets with an invalid type code. For Debian 9 stretch, this problem has been fixed in version 18-2+deb9u1. We recommend that you...

SUSE-SU-2020:2712-2 Security update for openldap2

This update for openldap2 fixes the following issues: - CVE-2020-8027: openldapupdatemodulespath.sh starts daemons unconditionally and uses fixed paths in /tmp bsc1175568...

CVE-2020-3550

A vulnerability in the sfmgr daemon of Cisco Firepower Management Center FMC Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to perform directory traversal and access directories outside the restricted path. The vulnerability is due to...

CVE-2020-3557

A vulnerability in the host input API daemon of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper certificate validation. An attacker could exploit...

Cisco Firepower Management Center Software Denial of Service Vulnerability

A vulnerability in the host input API daemon of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper certificate validation. An attacker could exploit...

CVE-2020-26895

Prior to 0.10.0-beta, LND Lightning Network Daemon would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation e.g., routing node, payment-receiver,...

CVE-2020-26895

Prior to 0.10.0-beta, LND Lightning Network Daemon would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation e.g., routing node, payment-receiver,...

Design/Logic Flaw

Prior to 0.11.0-beta, LND Lightning Network Daemon had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount...

Open redirect

Prior to 0.10.0-beta, LND Lightning Network Daemon would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation e.g., routing node, payment-receiver,...

CVE-2020-26896

The CVE affects LND (Lightning Network Daemon) prior to version 0.11.0-beta, specifically its invoice database. The root cause is that, when claiming an on-chain HTLC output, LND did not verify that the corresponding off-chain HTLC had already been settled before releasing the preimage. In a hash...

CVE-2020-26895

CVE-2020-26895 affects LND versions prior to 0.10.0-beta. The root cause is the handling of a counterparty high-S signature which could lead to the broadcast of invalid local commitment/HTLC transactions. This allows any peer with an open channel—whether routing node, payment-sender, or payment-r...