Important: qt, qt5-qtbase

Issue Overview: An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. readxbmbody in gui/image/qxbmhandler.cpp has a buffer over-read. CVE-2020-17507 Affected Packages: qt, qt5-qtbase Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit...

SUSE SLES12 Security Update : taglib (SUSE-SU-2020:2968-1)

This update for taglib fixes the following issues : CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file bsc1096180. Note that Tenable Network Security has extracted the preceding...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:3718-1)

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-15436: Fixed a use after free vulnerability in fs/blockdev.c which could have allowed local users to gain privileges or cause a denial of service...

NewStart CGSL CORE 5.04 / MAIN 5.04 : wireshark Multiple Vulnerabilities (NS-SA-2020-0064)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has wireshark packages installed that are affected by multiple vulnerabilities: - In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by...

SUSE-SU-2020:3715-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of servicebsc1179140. - CVE-2020-27777: Restrict RT...

SUSE-SU-2020:3714-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP1 Azure kernel was updated receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of servicebsc1179140. - CVE-2020-27777: Restrict RTAS...

SUSE-SU-2020:3713-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-15436: Fixed a use after free vulnerability in fs/blockdev.c which could have allowed local users to gain privileges or cause a denial of service...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5968)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5968 advisory. - crypto: authenc - fix parsing key with misaligned rtalen Eric Biggers Orabug: 31535530 CVE-2020-10769 Tenable has extracted the preceding description bloc...

Buffer Error Vulnerability in Multiple Qualcomm Products

A Qualcomm chip is a chip from Qualcomm Incorporated USA. It is a way of miniaturizing circuits mainly semiconductor devices, but also passive components, etc. and is often fabricated on the surface of semiconductor wafers. A buffer error vulnerability exists in several Qualcomm products, which...

Information Disclosure

SQLite is vulnerable to information disclosure. An attacker could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c leading to a disclosure of sensitive information...

Denial Of Service (DoS)

gpac is vulnerable to denial of service. A heap-based buffer over-read in isomedia/isomread.c in libgpac.a allows an attacker to crash the application from gfm2tssync in mediatools/mpegts.c...

Denial Of Service (DoS)

openexr is vulnerable to denial of service DoS. The vulnerability exists through a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution allows an attacker to crash the application and cause other unspecified impact...

Denial Of Service (DoS)

libxml2 is vulnerable to denial of service DoS. The vulnerability exists in the htmlParseTryOrFinish function in HTMLparser.c due to buffer-over-read, allowing an attacker to crash the application...

Buffer Over-Read

ImageMagick is vulnerable to buffer over-read. The vulnerability exist because memory allocation is not properly restricted...

Denial Of Service (DoS)

gpac is vulnerable to denial of service. A heap-based buffer over-read in BSReadByte called from gfbsreadbit in utils/bitstream.c allows an attacker to crash the application via a malicious MP4 file...

Denial Of Service (DoS)

GPAC is vulnerable to denial of service. The vulnerability existed because it contains a heap-based buffer over-read in gfm2tsprocesspmt in mediatools/mpegts.c that can cause a denial of service via a crafted MP4 file...

Denial Of Service (DoS)

qemu is vulnerable to denial of service DoS. The vulnerability exists through a stack-based buffer over-read hw/usb/hcd-ohci.c in QEMU 5.0.0 has via values obtained from the host controller driver allows an attacker to crash the application...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2020:2161-1 Rating: important References: 1149032 1152489 1153274 1154353 1155518 1160634 1167773 1170139 1171073 1171558 1172873 1173504 1174852 1175721 1175918 1176109 1176180 1176200 1176481 1176586...

[ASA-202012-7] libslirp: information disclosure

Arch Linux Security Advisory ASA-202012-7 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-29129 CVE-2020-29130 Package : libslirp Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1305 Summary ======= The package...

Hackers-For-Hire Group Develops New 'PowerPepper' In-Memory Malware

Cybersecurity researchers on Thursday disclosed details of a previously undiscovered in-memory Windows backdoor developed by a hacker-for-hire operation that can execute remotely malicious code and steal sensitive information from its targets in Asia, Europe, and the US. Dubbed "PowerPepper" by...