EulerOS 2.0 SP3 : freetype (EulerOS-SA-2019-2581)

According to the versions of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The parseencoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service infinite loop via a...

EulerOS 2.0 SP3 : elfutils (EulerOS-SA-2019-2573)

According to the versions of the elfutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The libelfsetrawdatawrlock function in elfgetdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service crash via a...

EulerOS 2.0 SP3 : exiv2 (EulerOS-SA-2019-2576)

According to the versions of the exiv2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service crash due to ...

CVE-2019-10487

CVE-2019-10487 affects Qualcomm Snapdragon family components (e.g., Snapdragon Auto/Compute/IoT lineups) and is caused by a buffer over-read while parsing SMS OTA messages at the transport layer when the network provides unintended values. The issue spans a wide set of Qualcomm/SC/MDM/SDA/SXR dev...

CVE-2019-10487

Buffer over read can happen while parsing SMS OTA messages at transport layer if network sends un-intended values in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ800...

EulerOS 2.0 SP3 : libarchive (EulerOS-SA-2019-2604)

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a fu...

EulerOS 2.0 SP3 : taglib (EulerOS-SA-2019-2672)

According to the version of the taglib package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure heap-based...

EulerOS 2.0 SP3 : netpbm (EulerOS-SA-2019-2635)

According to the versions of the netpbm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A memory allocation vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to...

Debian DLA-2040-1 : harfbuzz security update

An issue has been found in harfbuzz, an OpenType text shaping engine. Due to a buffer over-read, remote attackers are able to cause a denial of service or possibly have other impact via crafted data. For Debian 8 'Jessie', this problem has been fixed in version 0.9.35-2+deb8u1. We recommend that...

EulerOS 2.0 SP3 : tcpdump (EulerOS-SA-2019-2674)

According to the versions of the tcpdump package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - tcpdump 4.9.0 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via crafted packet data. Th...

EulerOS 2.0 SP3 : libsamplerate (EulerOS-SA-2019-2615)

According to the version of the libsamplerate package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In libsamplerate before 0.1.9, a buffer over-read occurs in the calcoutputsingle function in srcsinc.c via a crafted audio file.CVE-2017-7697...

RHEL 6 : freetype (RHSA-2019:4254)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4254 advisory. FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual...

EulerOS 2.0 SP3 : libXfont (EulerOS-SA-2019-2625)

According to the versions of the libXfont package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open but not read files on the system as root, triggering tape rewind...

EulerOS 2.0 SP3 : memcached (EulerOS-SA-2019-2631)

According to the versions of the memcached package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume Network Amplification, CWE-406 vulnerability in the UDP...

EulerOS 2.0 SP3 : ncurses (EulerOS-SA-2019-2634)

According to the versions of the ncurses packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In ncurses 6.1, there is a NULL pointer dereference at function ncparseentry in parseentry.c that will lead to a denial of service attack. The...

Debian: Security Advisory (DLA-2040-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : libplist (EulerOS-SA-2019-2613)

According to the versions of the libplist package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libplist allows attackers to cause a denial of service large memory allocation and crash via vectors involving an offset size of...

[SECURITY] [DLA 2040-1] harfbuzz security update

Package : harfbuzz Version : 0.9.35-2+deb8u1 CVE ID : CVE-2015-8947 An issue has been found in harfbuzz, an OpenType text shaping engine. Due to a buffer over-read, remote attackers are able to cause a denial of service or possibly have other impact via crafted data. For Debian 8 "Jessie", this...

runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory...

Moderate: Red Hat Security Advisory: freetype security update

An update for freetype is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...