Moderate: php:7.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later upstream version: php 7.2.24. BZ1726981 Security Fixes: php: Invalid memory access in function xmlrpcdecode CVE-2019-9020 php: File rename across filesystems...

CVE-2020-12284

cbsjpegsplitfragment in libavcodec/cbsjpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEGMARKERSOS handling because of a missing length check...

CVE-2020-12284

FFmpeg contains a heap-based buffer overflow in libavcodec/cbs_jpeg.c (cbs_jpeg_split_fragment) in versions 4.1 and 4.2.2, triggered during JPEG_MARKER_SOS processing due to a missing length check. This could lead to memory corruption. Several advisories reference CVE-2020-12284; fixes were issue...

CVE-2020-12284

cbsjpegsplitfragment in libavcodec/cbsjpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEGMARKERSOS handling because of a missing length check...

RHEL 8 : php:7.2 (RHSA-2020:1624)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1624 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later...

CVE-2020-12268

jbig2imagecompose in jbig2image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow...

CVE-2020-12268

jbig2imagecompose in jbig2image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow...

CVE-2020-12268

CVE-2020-12268 affects Artifex jbig2dec

CVE-2020-12268

jbig2imagecompose in jbig2image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow...

CVE-2020-12268

jbig2imagecompose in jbig2image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow...

Amazon Linux 2 : libvncserver (ALAS-2020-1411)

The version of libvncserver installed on the remote host is prior to 0.9.9-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1411 advisory. Integer Overflow or Wraparound leads to Heap-based Buffer Overflow CVE-2019-15690 Tenable has extracted the preceding...

Amazon Linux AMI : icu (ALAS-2020-1361)

The version of icu installed on the remote host is prior to 50.2-4.0. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1361 advisory. An issue was discovered in International Components for Unicode ICU for C/C++ through 66.1. An integer overflow, leading to a heap-base...

CVE-2019-20788

libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690...

CVE-2019-20788

libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690...

Integer overflow

libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690...

CVE-2019-20788

CVE-2019-20788 affects LibVNCServer (LibVNCClient) in libvncclient/cursor.c up to version 0.9.12, where HandleCursorShape can overflow an integer value and trigger a heap-based buffer overflow when a cursor shape with a large height or width is supplied. This corresponds to an impact on code hand...

CVE-2019-20788

libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690...

CVE-2020-11958

re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme...

Medium: icu

Issue Overview: An issue was discovered in International Components for Unicode ICU for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend function in common/unistr.cpp. CVE-2020-10531 Affected Packages: icu Issue Correction: Ru...

Important: libvncserver

Issue Overview: Integer Overflow or Wraparound leads to Heap-based Buffer Overflow CVE-2019-15690 Affected Packages: libvncserver Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue...