JerryScript security vulnerabilities

JerryScript, a lightweight JavaScript engine from the JerryScript project, has a denial-of-service vulnerability in version 3.0.0, which stems from a failed assertion in /jerry-core/ecma/base/ecma-helpers.c. An attacker could exploit this vulnerability to launch a denial of service...

Oracle Linux 8 : bind (ELSA-2021-4384)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4384 advisory. 32:9.11.26-6 - Use random entropy to generate unique TKEY identifiers 1980916 32:9.11.26-5 - Fix possible assertion failure iscrefcountcurrent == 0 in freerbtdb...

CLSA-2021-1636389447 Fixed CVEs in glibc: CVE-2021-43396, CVE-2021-3326

CVE-2021-3326: avoid denial of service due to a failed assertion - CVE-2021-43396: check actual stored character in state reset code...

EulerOS 2.0 SP2 : bind (EulerOS-SA-2021-2354)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses...

Denial Of Service

bind is vulnerable to denial of service. The vulnerability exists due the system terminated due to a failed assertion check...

CVE-2021-25218

In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerability affects only BIND 9 releases 9.16.1...

EulerOS 2.0 SP9 : bind (EulerOS-SA-2021-2262)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In BIND 9.8.5 - 9.8.8, 9.9.3 - 9.11.29, 9.12.0 - 9.16.13, and versions BIND 9.9.3-S1 - 9.11.29-S1 and 9.16.8-S1 - 9.16.13-S1 of BIND 9 Supported...

EulerOS Virtualization for ARM 64 3.0.2.0 : bind (EulerOS-SA-2021-2092)

According to the versions of the bind packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - In BIND 9.0.0 - 9.11.21, 9.12.0 - 9.16.5, 9.17.0 - 9.17.3, also affects 9.9.3-S1 - 9.11.21-S1 of the BIND 9 Supported...

OESA-2021-1244 openldap security update

OpenLDAP is an open source suite of LDAP Lightweight Directory Access Protocol applications and development tools. LDAP is a set of protocols for accessing directory services usually phone book style information, but other information is possible over the Internet, similar to the way DNS Domain...

CVE-2020-25710

A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23. The highest threat from this vulnerability is to system availability...

CVE-2020-25710: Reachable Assertion

A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23. The highest threat from this vulnerability is to system availability...

Oracle Linux 8 : bind (ELSA-2021-1989)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1989 advisory. 32:9.11.26-4 - Possible assertion failure on DNAME processing CVE-2021-25215 Tenable has extracted the preceding description block directly from the Oracle Linu...

Oracle Linux 6 : bind (ELSA-2021-9213)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-9213 advisory. 32:9.8.2-0.68.rc1.0.2.8 - Backport possible assertion failure on DNAME processing CVE-2021-25215 Tenable has extracted the preceding description block directly...

PT-2021-3136

Name of the Vulnerable Software and Affected Versions BIND versions 9.8.5 through 9.8.8 BIND versions 9.9.3 through 9.11.29 BIND versions 9.12.0 through 9.16.13 BIND 9 Supported Preview Edition versions 9.9.3-S1 through 9.11.29-S1 BIND 9 Supported Preview Edition versions 9.16.8-S1 through...

CVE-2021-24029

Summary of CVE-2021-24029 (mvfst/proxygen) : A specially crafted QUIC message can trigger a crash via a failed assertion in mvfst, treated as a connection error per QUIC spec. The issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to ...

CVE-2021-24029

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit...

PT-2021-15653

Name of the Vulnerable Software and Affected Versions: mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 proxygen versions prior to v2021.03.15.00 Description: A packet of death scenario is possible via a specially crafted message during a QUIC session, which causes a crash...

CVE-2021-24029: Reachable Assertion

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit...

glibc $ORIGIN Expansion Privilege Escalation Exploit

This Metasploit module attempts to gain root privileges on Linux systems by abusing a vulnerability in the GNU C Library glibc dynamic linker. glibc ld.so in versions before 2.11.3, and 2.12.x before 2.12.2 does not properly restrict use of the LDAUDIT environment variable when loading setuid...

glibc '$ORIGIN' Expansion Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/local/linux' require 'msf/core/exploit/exe' class MetasploitModule "glibc '$ORIGIN' Expansion Privilege Escalation", 'Description' = %q This...