UBUNTU-CVE-2020-14872

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

kernel: net: bluetooth: type confusion while processing AMP packets

A flaw was found in the way the Linux kernel’s Bluetooth implementation handled L2CAP Logical Link Control and Adaptation Protocol packets with A2MP Alternate MAC-PHY Manager Protocol CID Channel Identifier. This flaw allows a remote attacker in an adjacent range to crash the system, causing a...

A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

...

The vulnerability of the InitMS_ADPCM function in the Simple DirectMedia Layer library allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the InitMSADPCM function in the Simple DirectMedia Layer library is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the Cisco IOS XE operating system’s monitor ROMMON mode affects Cisco 4000 Series Integrated Services Routers, Cisco ASR 920 Series Aggregation Services Routers, Cisco ASR 1000 Series Aggregation Services Routers, and Cisco cBR-8 Converged Broadband Routers. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Cisco IOS XE operating system’s monitor ROMMON mode for Cisco 4000 Series Integrated Services Routers, Cisco ASR 920 Series Aggregation Services Routers, Cisco ASR 1000 Series Aggregation Services Routers, and Cisco cBR-8 Converged Broadband Routers is related to access...

ALPINE-CVE-2020-14361

A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

grub2: grub_malloc does not validate allocation size allowing for arithmetic overflow and subsequent heap-based buffer overflow

A flaw was found in current grub2 versions as shipped with Red Hat Enterprise Linux 7 and 8, where the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This issue leads the function to return invalid memory allocations, causing heap-based...

Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affects IBM Performance Management products

Summary Multiple vulnerabilities in the Oracle Java SE and the Java SE Embedded impact the IBM SDK, Java Technology Edition. Vulnerability Details CVEID: CVE-2019-2989 DESCRIPTION: An unspecified vulnerability in Java SE could allow an unauthenticated attacker to cause no confidentiality impact,...

nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload

A flaw was found in nodejs-minimist, where it was tricked into adding or modifying properties of the Object.prototype using a "constructor" or "proto" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

Unspecified Vulnerability in Oracle VM VirtualBox (CNVD-2020-40803)

Oracle Virtualization is a set of virtualization solutions from Oracle Corporation. The product is used to unify the management of the entire hardware and software system from applications to disks, enabling virtualization from the desktop to the data center.VM VirtualBox is one of the virtual...

kernel: out-of-bounds write via crafted keycode table

An out-of-bounds write flaw was found in the Linux kernel. A crafted keycode table could be used by drivers/input/input.c to perform the out-of-bounds write. A local user with root access can insert garbage to this keycode table that can lead to out-of-bounds memory access. The highest threat fro...

The vulnerability of the `libvncserver/rre.c` component of the cross-platform library LibVNCServer allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the libvncserver/rre.c component of the cross-platform library LibVNCServer arises from an operation that occurs outside the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of...

The vulnerability in the Cisco IOS XE operating system’s web interface, related to insufficient validation of input data, allows attackers to compromise the confidentiality, integrity, or accessibility of protected information.

The vulnerability of the Cisco IOS XE operating system’s web interface is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, or accessibility of protected information...

CVE-2020-12647

Unisys ALGOL Compiler 58.1 before 58.1a.15, 59.1 before 59.1a.9, and 60.0 before 60.0a.5 can emit invalid code sequences under rare circumstances related to syntax. The resulting code could, for example, trigger a system fault or adversely affect confidentiality, integrity, and availability...

Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8

Memory safety flaws were found in Mozilla Firefox and Thunderbird. Memory corruption that an attacker could leverage with enough effort, could allow arbitrary code to run. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8

Memory safety flaws were found in Mozilla Firefox and Thunderbird. Memory corruption that an attacker could leverage with enough effort, could allow arbitrary code to run. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

NETGEAR R7800 Command Injection Vulnerability (CNVD-2020-25354)

The NETGEAR R7800 is a router from NETGEAR. The NETGEAR R7800 suffers from a command injection vulnerability that can be exploited by an attacker to compromise confidentiality, integrity, and availability...

The vulnerability of Google Chrome browsers, related to memory usage after deallocation, allows attackers to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of Google Chrome relates to the use of memory after deallocation. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to information and compromise its integrity and availability through a specially created HTML page...

The vulnerability of Google Chrome, related to improper control of access to critical resources, allows attackers to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of Google Chrome relates to improper control of access to a critical resource when processing external protocols. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to information and compromise its integrity and availability throug...

Unspecified Vulnerability in Oracle Solaris (CNVD-2020-29609)

Oracle Solaris is a UNIX operating system from Oracle. An unspecified vulnerability exists in Oracle Solaris. An attacker could exploit this vulnerability to compromise Solaris, affecting the availability, confidentiality, and integrity of data...