Amazon Linux AMI : qemu-kvm (ALAS-2020-1400)

The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1400 advisory. In libslirp 4.1.0, as used in QEMU 4.2.0, tcpsubr.c misuses snprintf return values, leading to a buffer overflow in...

openSUSE Security Update : the Linux Kernel (openSUSE-2020-801)

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This...

Security Bulletin: Grep vulnerabilities affect IBM SmartCloud Entry (CVE-2012-5667)

Summary IBM SmartCloud Entry is vulnerable to several Grep vulnerabilities. Remote attackers can exploit them to obtain sensetive information or launch further attacks on the system. Vulnerability Details CVEID: CVE-2012-5667 DESCRIPTION: grep is vulnerable to a heap-based buffer overflow, caused...

Security Bulletin: Nss-util vulnerabilities affect IBM SmartCloud Entry( CVE-2016-1950 )

Summary IBM SmartCloud Entry is vulnerable to a nss-tuil vulnerability, attackers could exploit it to cause the application to crash. Vulnerability Details CVEID: CVE-2016-1950 DESCRIPTION: Mozilla Firefox is vulnerable to a heap-based buffer overflow, caused by improper bounds checking when the...

Important: Red Hat Security Advisory: jbig2dec security update

An update for jbig2dec is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Oracle Linux 8 : jbig2dec (ELSA-2020-2897)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-2897 advisory. 0.14-4 - Add explicit package version requirement on jbig2dec-libs to jbig2dec related: 1851057 0.14-3 - Fix CVE-2020-12268 resolves: 1851057 Tenable has...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5755)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5755 advisory. - p54usb: Fix race between disconnect and firmware loading Alan Stern Orabug: 31351863 CVE-2019-15220 - media: rc: prevent memory leak in cx23888irprob...

Important: Red Hat Security Advisory: jbig2dec security update

An update for jbig2dec is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Important: jbig2dec security update

jbig2dec is a decoder implementation of the JBIG2 image compression format. Security Fixes: jbig2dec: heap-based buffer overflow in jbig2imagecompose in jbig2image.c CVE-2020-12268 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

RHEL 8 : jbig2dec (RHSA-2020:2897)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2897 advisory. jbig2dec is a decoder implementation of the JBIG2 image compression format. Security Fixes: jbig2dec: heap-based buffer overflow in jbig2imagecompose...

Huawei EulerOS: Security Advisory for lz4 (EulerOS-SA-2020-1771)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for icu (EulerOS-SA-2020-1777)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

(0Day) Delta Industrial Automation DOPSoft DPA File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation DOPSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists withi...

CVE-2020-15470: Out-of-bounds Write

ffjpeg through 2020-02-24 has a heap-based buffer overflow in jfifdecode in jfif.c...

EulerOS Virtualization 3.0.6.0 : file (EulerOS-SA-2020-1778)

According to the version of the file packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - cdfreadpropertyinfo in cdf.c in file through 5.37 does not restrict the number of CDFVECTOR elements, which allows a heap-based buffer...

EulerOS Virtualization 3.0.6.0 : icu (EulerOS-SA-2020-1777)

According to the version of the icu package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - An issue was discovered in International Components for Unicode ICU for C/C++ through 66.1. An integer overflow, leading to a heap-based...

EulerOS Virtualization 3.0.6.0 : lz4 (EulerOS-SA-2020-1771)

According to the version of the lz4 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4write32 related to LZ4compressdestSize, affecting applications that call...

CVE-2017-18922

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow...

Delta Industrial Automation DOPSoft (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Delta Electronics Equipment: Delta Industrial Automation DOPSoft Vulnerabilities: Out-of-bounds Read, Heap-based Buffer Overflow 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory...

CVE-2020-14482: Heap-based Buffer Overflow

Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. Opening a specially crafted project file may overflow the heap, which may allow remote code execution, disclosure/modification of information, or cause the application to crash...