GHSA-GC94-6W89-HPQR Command Injection in fs-path

All versions of fs-path are vulnerable to command injection is unsanitized user input is passed in. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available...

GHSA-QR32-J4J6-3M7R Duplicate Advisory: Command Injection in fs-git

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wp3j-gv53-4pg8. This link is maintained to preserve external references. Original Description Affected versions of fs-git do not sanitize strings passed into the buildCommand method, resulting in arbitrary code...

Duplicate Advisory: Command Injection in fs-git

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wp3j-gv53-4pg8. This link is maintained to preserve external references. Original Description Affected versions of fs-git do not sanitize strings passed into the buildCommand method, resulting in arbitrary code...

Memory Corruption

Linux kernel is vulnerable to memory corruption attacks. This occurs in the fs/timerfd.c file which allows a local user to cause a kernel list corruption or use-after-free via simultaneous operations with a file descriptor which leverage improper mightcancel queuing. An unprivileged local user...

kernel security and bug fix update

2.6.32-754.14.2.OL6 - Update genkey bug 25599697 2.6.32-754.14.2 - x86 x86/speculation/mds: Add SMT warning message Waiman Long 1692386 1692387 1692388 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 - x86 x86/speculation/mds: Add mds=full, nosmt cmdline option Waiman Long 1692386 1692387 1692388...

Arbitrary File Overwrite

tar-fs is vulnerable to arbitrary file overwrite attacks. The attack is possible because it does not restrict the target of tarball containing hardlink from overwriting an existing file with an identical name as the hardlink, allowing arbitrary file overwrite attacks if an attacker gets control...

@capriza/far (>=0.1.2 <=2.4.2), @cobalt-engine/cobower (=2.0.0) +365 more potentially affected by CVE-2018-20835 via tar-fs (>=0.1.8 <=1.16.0)

tar-fs NPM version =0.1.8, =0.1.2, =6.0.3, =6.0.3, =6.0.3, =2.1.1, =0.10.2, =0.0.0-beta.1, =0.0.0-beta.1, =0.0.0-beta.1, =0.1.0, =0.1.0, =1.1.3, =1.1.15 - @monsieurbarti/micro-connector =3.1.7 and more Source cves: CVE-2018-20835 Source advisory: OSV:GHSA-X2MC-8FGJ-3WMR...

GHSA-X2MC-8FGJ-3WMR Improper Input Validation in tar-fs

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

Improper Input Validation in tar-fs

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

Design/Logic Flaw

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

CVE-2018-20835

CVE-2018-20835 affects tar-fs (node tar extraction library) before version 1.16.2. The vulnerability is an Arbitrary File Overwrite that occurs when extracting a tarball containing a hardlink to a file that already exists on the system, combined with a later plain file named the same as the hardl...

CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

CVE-2019-11191

The Linux kernel through 5.0.7, when CONFIGIA32AOUT is enabled and ia32aout is loaded, allows local users to bypass ASLR on setuid a.out programs if any exist because installexeccreds is called too late in loadaoutbinary in fs/binfmtaout.c, and thus the ptracemayaccess check has a race condition...

kernel security and bug fix update

2.6.32-754.12.1.OL6 - Update genkey bug 25599697 2.6.32-754.12.1 - x86 vDSO: Don't generate retpoline for indirect call Waiman Long 1638552 - fs cifs: fix reparse point/symlink breakage Leif Sahlberg 1636484 - scsi qla2xxx: Mask off Scope bits in retry delay Himanshu Madhani 1588133 - net tcp: ma...

CVE-2019-10125

CVE-2019-10125 affects the Linux kernel (up to v5.0.4) where aio_poll() in fs/aio.c may release a file by aio_poll_wake() after vfs_poll() returns, causing a use-after-free. Connected advisories (Unity Linux UTSA entries) reproduce the vulnerable description and map the issue to kernel code path ...

KB4467702: Windows 10 Version 1803 and Windows Server Version 1803 November 2018 Security Update

The remote Windows host is missing security update 4467702. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists in Microsoft JScript that could allow an attacker to bypass Device Guard. CVE-2018-8417 - An elevation of privilege vulnerability...

Security update for qemu (important)

openSUSE Security Update: Security update for qemu Announcement ID: openSUSE-SU-2019:0254-1 Rating: important References: 1063993 1079730 1100408 1101982 1112646 1114957 1116717 1117275 1119493 1121600 1123156 1123179 Cross-References: CVE-2018-16872 CVE-2018-18954 CVE-2018-19364 CVE-2018-19489...