CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

CVE-2018-20835

CVE-2018-20835 affects tar-fs (node tar extraction library) before version 1.16.2. The vulnerability is an Arbitrary File Overwrite that occurs when extracting a tarball containing a hardlink to a file that already exists on the system, combined with a later plain file named the same as the hardl...

CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

kernel security and bug fix update

2.6.32-754.12.1.OL6 - Update genkey bug 25599697 2.6.32-754.12.1 - x86 vDSO: Don't generate retpoline for indirect call Waiman Long 1638552 - fs cifs: fix reparse point/symlink breakage Leif Sahlberg 1636484 - scsi qla2xxx: Mask off Scope bits in retry delay Himanshu Madhani 1588133 - net tcp: ma...

CVE-2019-11191

The Linux kernel through 5.0.7, when CONFIGIA32AOUT is enabled and ia32aout is loaded, allows local users to bypass ASLR on setuid a.out programs if any exist because installexeccreds is called too late in loadaoutbinary in fs/binfmtaout.c, and thus the ptracemayaccess check has a race condition...

CVE-2019-10125

CVE-2019-10125 affects the Linux kernel (up to v5.0.4) where aio_poll() in fs/aio.c may release a file by aio_poll_wake() after vfs_poll() returns, causing a use-after-free. Connected advisories (Unity Linux UTSA entries) reproduce the vulnerable description and map the issue to kernel code path ...

KB4467702: Windows 10 Version 1803 and Windows Server Version 1803 November 2018 Security Update

The remote Windows host is missing security update 4467702. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists in Microsoft JScript that could allow an attacker to bypass Device Guard. CVE-2018-8417 - An elevation of privilege vulnerability...

Security update for qemu (important)

openSUSE Security Update: Security update for qemu Announcement ID: openSUSE-SU-2019:0254-1 Rating: important References: 1063993 1079730 1100408 1101982 1112646 1114957 1116717 1117275 1119493 1121600 1123156 1123179 Cross-References: CVE-2018-16872 CVE-2018-18954 CVE-2018-19364 CVE-2018-19489...

DEBIAN-CVE-2019-8980

A memory leak in the kernelreadfile function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service memory consumption by triggering vfsread failures...

CVE-2019-8980

CVE-2019-8980 is a memory-leak DoS in the Linux kernel (kernel_read_file in fs/exec.c) affecting up to version 4.20.11. Attackers could trigger vfs_read failures to exhaust memory. The connected documents provide the vulnerability description but do not specify a confirmed fixed/patch version or ...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service. The AIO interface permitted reading or writing 2 GB of data or more in a single chunk, which could lead to an integer overflow in the aiosetupsinglevector function in fs/aio.c when applied to certain filesystems, socket or device types...

Denial Of Service (DoS)

kernel-rt is vulnerable to denial of service. Incorrect handling of the Delay and Unwritten buffer head states in the journalunmapbuffer function in fs/jbd2/transaction.c allows local attackers to crash systems that have an ext4 file system with a journal mounted...

Security Bulletin: Vulnerabilities in the Linux Kernel affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in the Linux Kernel. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2018-1066 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in the...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:4069-1)

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device with zero interfaces that is mishandled i...

CVE-2018-11906

CVE-2018-11906 affects Android releases (Android for MSM, Firefox OS for MSM, QRD Android) built from CAF Linux kernel. The vulnerability is due to default privileged access to ADB and debug-fs, enabling local attackers with low complexity to achieve high-impact confidentiality, integrity, and av...

CVE-2018-11906

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, there is a security concern with default privileged access to ADB and debug-fs...

Design/Logic Flaw

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, there is a security concern with default privileged access to ADB and debug-fs...

CVE-2018-11906

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, there is a security concern with default privileged access to ADB and debug-fs...

Cross site scripting

A cross-site-scripting XSS vulnerability exists when an open source customization for Microsoft Active Directory Federation Services AD FS does not properly sanitize a specially crafted web request to an affected AD FS server, aka "Active Directory Federation Services XSS Vulnerability." This...

CVE-2018-8547

CVE-2018-8547 is a cross-site scripting (XSS) vulnerability in an open-source customization for Microsoft Active Directory Federation Services (AD FS). Affected components are AD FS servers on Windows platforms (e.g., Windows Server 2012 R2, 2016, 2019, etc.). The issue arises because the customi...