Ubuntu 20.04 LTS : Linux kernel (KVM) vulnerabilities (USN-5000-2)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5000-2 advisory. USN-5000-1 fixed vulnerabilities in the Linux kernel for Ubuntu 20.04 LTS and the Linux HWE kernel for Ubuntu 18.04 LTS. This update provides the...

RHEL 7 : kernel-rt (RHSA-2021:3439)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3439 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Securi...

RHEL 7 : kpatch-patch (RHSA-2021:3441)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3441 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Security Fixe...

SUSE SLED15 / SLES15 Security Update : xerces-c (SUSE-SU-2021:2958-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2958-1 advisory. - CVE-2018-1311: Fixed use-after-free inside XML parser during the scanning of external DTDs bsc1159552. Tenable has extracted the preceding...

Huawei EulerOS: Security Advisory for bluez (EulerOS-SA-2021-2321)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-28553 Adobe Acrobat Reader use-after-free vulnerability could lead to arbitrary code execution

Acrobat Reader DC versions versions 2021.001.20150 and earlier, 2020.001.30020 and earlier and 2017.011.30194 and earlier are affected by an Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the curren...

SUSE-SU-2021:2920-1 Security update for xerces-c

This update for xerces-c fixes the following issues: - CVE-2018-1311: Fixed use-after-free inside XML parser during the scanning of external DTDs bsc1159552...

Design/Logic Flaw

XMP Toolkit SDK versions 2020.1 and earlier are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2021-40145

gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes...

Double free

DISPUTED gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purpose...

CVE-2021-40145

gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes...

GHSA-2F5J-3MHQ-XV58 Double free in sys-info

Affected versions of sys-info use a static, global, list to store temporary disk information while running. The function that cleans up this list, DFCleanup, assumes a single threaded environment and will try to free the same memory twice in a multithreaded environment. This results in consistent...

GHSA-6RHX-HQXM-8P36 Double free in http

An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness...

CVE-2021-36008

Adobe Illustrator version 25.2.3 and earlier is affected by an Use-after-free vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to read arbitrary file system information in the context of the current user. Exploitation of this issue...

Design/Logic Flaw

Acrobat Reader DC versions 2021.005.20054 and earlier, 2020.004.30005 and earlier and 2017.011.30197 and earlier are affected by an Use-after-free vulnerability. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user...

Design/Logic Flaw

Acrobat Reader DC versions 2021.005.20054 and earlier, 2020.004.30005 and earlier and 2017.011.30197 and earlier are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user...

CVE-2021-28641

CVE-2021-28641 is an Adobe Acrobat Reader Use-After-Free vulnerability affecting Acrobat Reader DC (versions 2021.005.20054 and earlier; 2020.004.30005 and earlier; 2017.011.30197 and earlier). The flaw allows arbitrary code execution in the context of the current user and is exploitable by an un...

CVE-2021-28593 Adobe Illustrator PostScript Parsing Use-After-Free Information Disclosure Vulnerability

Adobe Illustrator version 25.2.3 and earlier is affected by a Use After Free vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose potential sensitive information in the context of the current user. Exploitation of this issu...

Design/Logic Flaw

An use-after-free vulnerability in the libpffitemtreecreatenode function of libyal Libpff before 20180623 allows attackers to cause a denial of service DOS or execute arbitrary code via a crafted pff file...

KLA12267 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in ANGLE can be exploited to cause denial of service or...