Cisco Patches Recently Disclosed "sudo" Vulnerability (CVE-2021-3156) in Multiple Products

While Punxsutawney Phil may have said we only have six more weeks of winter, the need to patch software and hardware weaknesses will, unfortunately, never end. Cisco has released security updates to address vulnerabilities in most of their product portfolio, some of which may be exploited to gain...

CVE-2020-27247

A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0002, an attacker can entice the...

CVE-2020-27249

A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0004 and 0x0015, an attacker can...

CVE-2020-27248

A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0003 and 0x0014, an attacker can...

CVE-2020-13580

An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser to explicitly trust a length from a particular record type and use it to writ...

Heap overflow

A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0003 and 0x0014, an attacker can...

CVE-2020-27249

A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0004 and 0x0015, an attacker can...

CVE-2020-27248

CVE-2020-27248 affects SoftMaker Office PlanMaker 2021 (Revision 1014). The vulnerability arises in Office Art/Office drawing parsing: specifically MsoDrawingGroup with nested OfficeArt records and 0x00eb, 0xf000, and 0xf150 sub-records. Depending on Version/Instance (0x0003/0x0014, 0x0004/0x0015...

CVE-2020-27247

A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0002, an attacker can entice the...

CVE-2020-13579

SoftMaker Office PlanMaker 2021 contains an exploitable integer overflow in the PlanMaker document parser. In the PMW document processing, a 32-bit value read from the record payload is trusted and multiplied by 8, which can overflow and lead to an undersized heap allocation. The code then writes...

CVE-2020-13580

CVE-2020-13580 affects SoftMaker Office PlanMaker 2021. The issue is a heap-based buffer overflow inside the PlanMaker document parser, triggered by a crafted PMW/PlanMaker record (notably 0x8010). The vulnerability arises when the parser reads a 16-bit length from a record, clamps it to 10, but ...

CVE-2020-13580

An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser to explicitly trust a length from a particular record type and use it to writ...

perl security update

CentOS Errata and Security Advisory CESA-2021:0343 An update for perl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Apple macOS ModelIO USD Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with the ModelIO library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the ModelIO...

EulerOS 2.0 SP5 : libvncserver (EulerOS-SA-2021-1208)

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service...

Fedora 32 : netpbm (2021-f62099fe51)

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-f62099fe51 advisory. - The pmmallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03 allows remote attackers to cause a denial of service heap-based buffer...

EulerOS 2.0 SP5 : gd (EulerOS-SA-2021-1189)

According to the versions of the gd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Integer signedness error in GD Graphics Library 2.1.1 aka libgd or libgd2 allows remote attackers to cause a denial of service crash or potentially...

EulerOS 2.0 SP5 : zziplib (EulerOS-SA-2021-1240)

According to the versions of the zziplib package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Heap-based buffer overflow in the zzipget32 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service crash vi...

EulerOS 2.0 SP5 : ImageMagick (EulerOS-SA-2021-1195)

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteUILImage function in...

EulerOS 2.0 SP5 : ghostscript (EulerOS-SA-2021-1193)

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a...