USN-4369-1: Linux kernel vulnerabilities

It was discovered that the btrfs implementation in the Linux kernel did not properly detect that a block was marked dirty in some situations. An attacker could use this to specially craft a file system image that, when unmounted, could cause a denial of service system crash. CVE-2019-19377 Trista...

USN-4369-1 linux, linux-aws, linux-aws-5.3, linux-azure, linux-azure-5.3, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-oracle-5.3, linux-raspi2 vulnerabilities

It was discovered that the btrfs implementation in the Linux kernel did not properly detect that a block was marked dirty in some situations. An attacker could use this to specially craft a file system image that, when unmounted, could cause a denial of service system crash. CVE-2019-19377 Trista...

CVE-2020-1118

A denial of service vulnerability exists in the Windows implementation of Transport Layer Security TLS when it improperly handles certain key exchanges, aka 'Microsoft Windows Transport Layer Security Denial of Service Vulnerability'...

Google Chrome ANGLE Resource Management Error Vulnerability

Google Chrome is a web browser from Google.Almost Native Graphics Layer Engine ANGLE is a graphics layer engine that allows Windows users to run WebGL and other OpenGL ES 2.0 content by translating the OpenGL ES 2.0 API to DirectX 9 or DirectX 11 API calls. DirectX 11 API calls to run WebGL and...

OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-4367-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4367-1 advisory. It was discovered that the btrfs implementation in the Linux kernel did not properly detect that a block was marked dirty in some situations. An attacker...

USN-4368-1: Linux kernel vulnerabilities

Tristan Madani discovered that the file locking implementation in the Linux kernel contained a race condition. A local attacker could possibly use this to cause a denial of service or expose sensitive information. CVE-2019-19769 It was discovered that the Serial CAN interface driver in the Linux...

The vulnerability of the implementation library for the Transport Layer Security protocol of Cisco Firepower Threat Defense micro-programming software allows a attacker to compromise the integrity of the protected information.

The vulnerability of the Transport Layer Security protocol implementation library in Cisco Firepower Threat Defense software relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...

Ubuntu: Security Advisory (USN-4363-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the implementations of Secure Sockets Layer and Transport Layer Security protocols in the microsoftware for Cisco Adaptive Security Appliance (ASA) and Configure Firepower Threat Defense (FTD) allows a attacker to induce a service failure.

The vulnerability of the Secure Sockets Layer and Transport Layer Security implementations in Cisco Adaptive Security Appliance ASA and Configure Firepower Threat Defense FTD software lies in an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to caus...

Securing GraphQL API

Introduction to GraphQL Representational state transfer REST APIs are the most popular type of API. However, GraphQL is rapidly growing in popularity as a competitor to REST. GraphQL is a meta-layer with built-in query language to access object-oriented data. It’s based on JSON-encoded HTTP...

undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS

A vulnerability was found in the Undertow HTTP server listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service DOS to make the service unavailable on SSL...

The vulnerability of the Secure Sockets Layer and Transport Layer Security implementations in Cisco Firepower Threat Defense’s microprogramming-based network interface controllers allows attackers to induce service failures.

The vulnerability of the Secure Sockets Layer and Transport Layer Security implementations of Cisco Firepower Threat Defense’s microprogramming-based network interface controllers is related to the execution of operations beyond the buffer in memory. Exploitation of this vulnerability could allow...

Cisco Firepower Threat Defense Software SSL/TLS URL Category Bypass Vulnerability (cisco-sa-ssl-bypass-O5tGum2n)

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a remote code execution vulnerability in Transport Layer Security. This is due to logic error withing SNORT handling. An unauthenticated, remote attacker can exploit this to bypass web traffic policies...

Microsoft Windows and Windows Server Denial of Service Vulnerability (CNVD-2020-33424)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. A denial of service vulnerability exists in the implementation of the Transport Layer...

FreeBSD : FreeBSD -- Improper checking in SCTP-AUTH shared key update (253486f5-947d-11ea-92ab-00163e433440)

The SCTP layer does improper checking when an application tries to update a shared key. Therefore an unprivileged local user can trigger a use-after- free situation, for example by specific sequences of updating shared keys and closing the SCTP association. Impact : Triggering the use-after-free...

keycloak: improper verification of certificate with host mismatch could result in information disclosure

A flaw was found in Keycloak, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle MITM attack...

Microsoft Windows Transport Layer Security Denial of Service Vulnerability

A denial of service vulnerability exists in the Windows implementation of Transport Layer Security TLS when it improperly handles certain key exchanges. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. To exploit this vulnerability, a remote...

PT-2020-19991 · Nextcloud · Nextcloud Mail

Name of the Vulnerable Software and Affected Versions: Nextcloud Mail version 1.1.3 Description: A missing verification of the TLS host allowed a man-in-the-middle attack. Recommendations: For Nextcloud Mail version 1.1.3, update to a version that includes the fix for the missing TLS host...

Zephyr Trust Management Issues Vulnerabilities

Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. A trust management issue vulnerability exists in the UpdateHub module in Zephyr 2.1.0 and later fixed in version 2.2.0, which stems from the program disabling DTLS peer checking. An attacker could use...