CVE-2020-15588

CVE-2020-15588 affects the client side of Zoho ManageEngine Desktop Central (notably pre-10.0.533/10.0.552.W variants). The root cause is an integer overflow in the client’s handling of HTTP/headers that can be triggered by an attacker-controlled server via untrusted communication, leading to a h...

CVE-2020-14309

A flaw was found in grub2. When handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size, the name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data. The highes...

CVE-2020-14311

There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow...

Node.js 10.x < 10.21.0 Buffer Overflow Vulnerability - Windows

Node.js is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodejs:node.js"; ifdescripti...

Microsoft Edge (Chromium) < 84.0.522.40 Multiple Vulnerabilities

The version of Microsoft Edge Chromium installed on the remote Windows host is prior to 84.0.522.40. It is, therefore, affected by multiple vulnerabilities : - Heap-based buffer overflow in PDFium allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. CVE-2020-65...

Debian DLA-2292-1 : milkytracker security update

Several vulnerabilities were fixed in MilkyTracker, a music tracker for composing music in the MOD and XM module file formats. CVE-2019-14464 Heap-based buffer overflow in XMFile::read CVE-2019-14496 Stack-based buffer overflow in LoaderXM::load CVE-2019-14497 Heap-based buffer overflow in...

Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM Sterling Connect:Express for Unix

Summary OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by IBM Sterling Connect:Express for UNIX. IBM Sterling Connect:Express for UNIX has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2107 DESCRIPTION: OpenSSL could allow a...

Security Bulletin: Multiple vulnerabilities in GNU Binutils affect IBM Netezza Platform Software clients.

Summary GNU Binutils is used by IBM Netezza Platform Software. IBM Netezza Platform Software has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-17450 DESCRIPTION: GNU Binutils is vulnerable to a denial of service, caused by an infinite recursion in findabstractinstance in...

Heap overflow

Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free...

CVE-2020-15888

Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free...

CVE-2020-15866

mruby through 2.1.2-rc has a heap-based buffer overflow in the mrbyieldwithclass function in vm.c because of incorrect VM stack handling. It can be triggered via the stackcopy function...

Important: Red Hat Security Advisory: jbig2dec security update

An update for jbig2dec is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

openSUSE Security Update : the Linux Kernel (openSUSE-2020-801)

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This...

Amazon Linux AMI : qemu-kvm (ALAS-2020-1400)

The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1400 advisory. In libslirp 4.1.0, as used in QEMU 4.2.0, tcpsubr.c misuses snprintf return values, leading to a buffer overflow in...

Security Bulletin: Grep vulnerabilities affect IBM SmartCloud Entry (CVE-2012-5667)

Summary IBM SmartCloud Entry is vulnerable to several Grep vulnerabilities. Remote attackers can exploit them to obtain sensetive information or launch further attacks on the system. Vulnerability Details CVEID: CVE-2012-5667 DESCRIPTION: grep is vulnerable to a heap-based buffer overflow, caused...

Security Bulletin: Nss-util vulnerabilities affect IBM SmartCloud Entry( CVE-2016-1950 )

Summary IBM SmartCloud Entry is vulnerable to a nss-tuil vulnerability, attackers could exploit it to cause the application to crash. Vulnerability Details CVEID: CVE-2016-1950 DESCRIPTION: Mozilla Firefox is vulnerable to a heap-based buffer overflow, caused by improper bounds checking when the...

Important: Red Hat Security Advisory: jbig2dec security update

An update for jbig2dec is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Oracle Linux 8 : jbig2dec (ELSA-2020-2897)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-2897 advisory. 0.14-4 - Add explicit package version requirement on jbig2dec-libs to jbig2dec related: 1851057 0.14-3 - Fix CVE-2020-12268 resolves: 1851057 Tenable has...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5755)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5755 advisory. - p54usb: Fix race between disconnect and firmware loading Alan Stern Orabug: 31351863 CVE-2019-15220 - media: rc: prevent memory leak in cx23888irprob...

Important: Red Hat Security Advisory: jbig2dec security update

An update for jbig2dec is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...