Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

...

UBUNTU-CVE-2020-12403

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and strictly enforcing tag length...

PT-2020-19726 · Nis-Utils · Nis-Utils

Name of the Vulnerable Software and Affected Versions: nis-utils versions up to and including 0.6.10 Description: The issue concerns Prototype Pollution via the setValue function. This affects all versions of the package up to and including 0.6.10. Recommendations: For versions up to and includin...

PT-2020-6622 · Faad2 +4 · Faad2 +4

Name of the Vulnerable Software and Affected Versions: faad2 versions through 2.10.0 Description: An issue exists in the function ftypin located in mp4read.c, which allows for a stack-buffer-overflow. This enables an attacker to cause code execution. The vulnerability is related to a buffer...

OPENSUSE-SU-2020:1215-1 Security update for chromium

This update for chromium fixes the following issues: - Chromium updated to 84.0.4147.125 boo1175085 CVE-2020-6542: Use after free in ANGLE CVE-2020-6543: Use after free in task scheduling CVE-2020-6544: Use after free in media CVE-2020-6545: Use after free in audio CVE-2020-6546: Inappropriate...

OPENSUSE-SU-2020:1214-1 Security update for chromium

This update for chromium fixes the following issues: - Chromium updated to 84.0.4147.125 boo1175085 CVE-2020-6542: Use after free in ANGLE CVE-2020-6543: Use after free in task scheduling CVE-2020-6544: Use after free in media CVE-2020-6545: Use after free in audio CVE-2020-6546: Inappropriate...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2020:1214-1 Rating: important References: 1174497 1175044 1175085 Cross-References: CVE-2020-6542 CVE-2020-6543 CVE-2020-6544 CVE-2020-6545 CVE-2020-6546 CVE-2020-6547 CVE-2020-6548 CVE-2020-6549 CVE-2020-6550...

openSUSE: Security Advisory for chromium (openSUSE-SU-2020:1206-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PT-2020-6461

Name of the Vulnerable Software and Affected Versions QEMU version 5.0.0 Description The issue is related to the hw/usb/hcd-ohci.c component in the QEMU hardware emulator, which can lead to an infinite loop when a TD list has a loop. This can cause a denial of service. Recommendations For QEMU...

CVE-2020-16138

A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our...

Information disclosure

A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our...

CVE-2020-16138

A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our...

CVE-2020-4485

IBM QRadar 7.2.0 through 7.2.9 could allow an authenticated user to disable the Wincollect service which could aid an attacker in bypassing security mechanisms in future attacks. IBM X-Force ID: 181860...

PT-2020-14770 · Cisco · Cisco Unified Ip Conference Station 7937G

Name of the Vulnerable Software and Affected Versions: Cisco Unified IP Conference Station 7937G versions 1-4-4-0 through 1-4-5-7 Description: A denial-of-service issue allows attackers to remotely disable the device until it is power cycled. The product is end of life and users are advised to...

DEBIAN-CVE-2020-15138

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism =v1.1.0 that use the Previewers plugin...

UBUNTU-CVE-2020-15138

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism =v1.1.0 that use the Previewers plugin...

RHEL 8 : kernel (RHSA-2020:1372)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1372 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: powerpc: local user can read...

kernel: Indirect branch speculation can be enabled after it was force-disabled by the PR_SPEC_FORCE_DISABLE prctl command.

A flaw was found in the prctl function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to...

nss and nspr security, bug fix, and enhancement update

nspr 4.25.0-2 - Rebuild 4.25.0-1 - Update to NSPR 4.25 nss 3.53.1-11 - Fix issue with upgradedb where upgradedb expects standard to generate dbm databases, not sql databases default in RHEL8 3.53.1-10 - Disable dh timing test because it's unreliable on s390 3.53.1-9 - Explicitly enable...

USN-4440-1: linux kernel vulnerabilities

It was discovered that the network block device nbd implementation in the Linux kernel did not properly check for error conditions in some situations. An attacker could possibly use this to cause a denial of service system crash. CVE-2019-16089 It was discovered that the kernel-user space relay...