log4j: improper validation of certificate with host mismatch in SMTP appender

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to access sensitive data, compromise its integrity, and cause service failures.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mismatches. Exploiting this vulnerability can allow an attacker to gain access to sensitive data, compromise its integrity, and cause service failures...

RHEL 7 : kernel (RHSA-2021:0878)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0878 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: locking issue in...

bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data...

March 15, 2021—KB5001568 (OS Build 17763.1821) Out-of-band

None None...

March 15, 2021—KB5001566 (OS Build 18363.1441) Out-of-band

None None...

kernel: TOCTOU mismatch in the NFS client code

A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response allow for local memory corruption and possibly privilege escalation...

RHEL 7 : kernel (RHSA-2021:0760)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0760 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: umask not applied on filesyste...

CVE-2021-25345

Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupported format...

CVE-2021-25345

Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupported format...

CVE-2021-25345

CVE-2021-25345 concerns Samsung hwcomposer. Descriptions across sources identify a graphics format mismatch when hwcomposer converts video formats, occurring prior to SMR Mar-2021 Release 1, which results in a kernel panic due to an unsupported format. The vulnerability is tied to the hwcomposer ...

CVE-2021-25345

Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupported format...

hwcomposer 安全漏洞

Samsung hwcomposer is a mobile application from Samsung South Korea. It provides video conversion format functionality. A security vulnerability exists in hwcomposer prior to SMR Mar-2021 Release 1, which stems from a graphics format mismatch when hwcomposer converts video formats...

CVE-2021-20230

A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to...

ALPINE-CVE-2021-26713

A stack-based buffer overflow in resrtpasterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession...

CVE-2021-26713

A stack-based buffer overflow in resrtpasterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession...

UBUNTU-CVE-2021-26713

A stack-based buffer overflow in resrtpasterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession...

PT-2021-6078 · Go +6 · Go +6

Name of the Vulnerable Software and Affected Versions: Go versions through 1.16.5 Description: The issue arises from insufficient certificate authentication in the crypto/tls package of the Go programming language. This can be exploited by a remote attacker to cause a denial of service...

Digium Certified Asterisk Buffer Error Vulnerability

Digium Certified Asterisk is a set of open source telephone exchange PBX system software from Digium, USA. The software supports voicemail, multi-party voice conferencing, interactive voice response IVR, and more. A buffer error vulnerability exists in Digium Certified Asterisk. The vulnerability...

log4j: improper validation of certificate with host mismatch in SMTP appender

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...