XStream: remote code execution due to insecure XML deserialization when relying on blocklists

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application...

postgresql: Reconnection can downgrade connection security settings

A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could...

postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

CVE-2021-20190

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigation The following conditions are needed for an exploit, w...

MGASA-2021-0036 Updated bind packages fix security vulnerability

A flaw was found in bind. An assertion failure can occur when trying to verify a truncated response to a TSIG-signed request. The highest threat from this vulnerability is to system availability CVE-2020-8622. A flaw was found in bind. Updates to "Update-policy" rules of type "subdomain" are...

Updated kernel-linus packages fix security vulnerabilities

This update provides an upgrade to the new upstream 5.10 longterm branch, currently based on 5.10.6, adding new features and new and improved hardware support. This update also fixes at least the following security issues: In binderreleasework of binder.c, there is a possible use-after-free due t...

The vulnerability of the PHP programming language interpreter, related to improper storage of permissions, allows attackers to compromise data integrity.

The vulnerability of the PHP programming language interpreter is related to improper storage of permissions. Exploiting this vulnerability allows an attacker to influence the integrity of data...

The vulnerability of Google Chrome, related to the use of memory after it is freed, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of Google Chrome relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

XStream: remote code execution due to insecure XML deserialization when relying on blocklists

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application...

The vulnerability of Firefox browsers, Firefox ESR, and the Thunderbird email client relates to the issue of operations beyond the buffer in memory. This allows attackers to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of Firefox browsers, Firefox ESR, and the email client Thunderbird is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to information and compromise its integrity and...

The vulnerability of the fly-wm window manager, related to the bypassing of authentication due to a fundamental error, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the fly-wm window manager is related to the password prompt displayed during session blocking. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of Firefox browsers, Firefox ESR, and the Thunderbird email client relates to the issue of operations beyond buffer boundaries in memory. This allows attackers to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of Firefox browsers, Firefox ESR, and the email client Thunderbird is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to information and compromise its integrity and...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2021-9007)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9007 advisory. - xen-blkback: set ring-xenblkd to NULL after kthreadstop Pawel Wieczorkiewicz Orabug: 32260252 CVE-2020-29569 - xenbus/xenbusbackend: Disallow...

The vulnerability in the implementation of the Strict Transport Security (HSTS) mechanism of the Mozilla Firefox browser allows a perpetrator to compromise the integrity of data.

The vulnerability of the Strict Transport Security HSTS mechanism implemented by Mozilla Firefox is related to incorrect elimination of special elements in the output data used by the incoming component. Exploiting this vulnerability can allow a remote attacker to compromise the integrity of the...

The vulnerability of the driver of the Windows Cloud Files mini-filter operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Windows Cloud Files mini-filter driver in the Windows operating system is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability in Firefox ESR and Firefox web browsers, as well as in the Thunderbird email client, relates to the execution of operations beyond the allowed data buffer limits. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability in Firefox ESR and Firefox web browsers, as well as in the Thunderbird email client, is related to the execution of operations beyond the allowed data buffer limits. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity...

The vulnerability of the “ALTER ... DEPENDS ON EXTENSION” component in the PostgreSQL database management system allows a attacker to compromise data integrity.

The vulnerability of the “ALTER ... DEPENDS ON EXTENSION” component in the PostgreSQL database management system is related to the absence of an authentication mechanism. Exploiting this vulnerability could allow a perpetrator to compromise the integrity of the data...

The vulnerability of the NTP network protocol, related to errors in data processing, allows attackers to compromise the integrity of data.

The vulnerability of the NTP network protocol is related to errors in data processing. Exploiting this vulnerability can allow a remote attacker to compromise the integrity of data...