1075 matches found
CVE-2019-3691
A Symbolic Link Symlink Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE Linux Enterprise Server 15 munge versions prior to 0.5.13-4.3.1. openSUSE...
CVE-2019-3691
CVE-2019-3691 is a local privilege escalation in the munge packaging for SUSE Linux Enterprise Server 15 and openSUSE Factory, caused by a Symbolic Link (Symlink) Following issue. Affected Munge versions are prior to 0.5.13-4.3.1 on SLES 15 and prior to 0.5.13-6.1 on openSUSE Factory. The vulnera...
How to change the default lifetime of Compositing Engine packaging machine in ELM
By default, if finalization has not begun in 3 days of time since the Packaging Machine was created, the task will be canceled with a timeout error. On the ELM logs, you may see something like the below: 2020-01-02 13:43:59,486 ERROR 61605 CompositingEngineP: Timeout occured after...
12 bug fix update
An update is available for nodejs-nodemon, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The following packages have been upgraded to a later...
MGASA-2019-0361 Updated clamav packages fix security vulnerability
The updated packages fix two packaging problems and a security vulnerability: A Denial-of-Service DoS vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times. CVE-2019-15961 The first packaging issue, in the configuration of...
Updated clamav packages fix security vulnerability
The updated packages fix two packaging problems and a security vulnerability: A Denial-of-Service DoS vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times. CVE-2019-15961 The first packaging issue, in the configuration of...
Advanced Packaging Tools Data Forgery Issue Vulnerability
Advanced Packaging Tools APT is a package manager that automatically downloads, configures, and installs packages in binary or source code format. There is a data forgery problem vulnerability in apt-key in APT, which can be exploited by an attacker to execute a man-in-the-middle attack...
Kali Linux 2019.4 Release - Penetration Testing and Ethical Hacking Linux Distribution
We are incredibly excited to announce our fourth and final release of 2019, Kali Linux 2019.4. 2019.4 includes some exciting new updates: A new default desktop environment, Xfce New GTK3 theme for Gnome and Xfce Introduction of “Kali Undercover” mode Kali Documentation has a new home and is now G...
PT-2020-10912 · Suse +1 · Opensuse Leap +3
Name of the Vulnerable Software and Affected Versions: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1 SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1 openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions Description: A symlink...
Design/Logic Flaw
In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service DoS via a special file such as /dev/urandom, via...
CVE-2019-18658
The CVE-2019-18658 issue concerns Helm 2.x before 2.15.2, where commands loading a chart as a directory or packaging could be exploited by a malicious chart to leak sensitive content (e.g., /etc/passwd) or trigger DoS via symlinks to files like /dev/urandom. It is described as a client‑side issue...
OS Layer Finalize fails with error "It looks like the packaging Machine has never been powered on".
While finalizing an OS layer edit in the App Layering appliance, you receive an error,"It looks like the packaging Machine has never been powered on." Can see the below error in ELM logs: 2019-11-01 09:53:36,890 ERROR 27 CpTaskResultMessag: Got Error type GlobalizedError. FailureReason: It looks...
dhcp: double-deletion of the released addresses in the dhcpv6 code leading to crash and possible DoS
There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All...
new module: nodejs:12
An update is available for nodejs-nodemon, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This enhancement update adds the nodejs:12 module to...
AZL-34558 CVE-2019-6470 affecting package bind for versions less than 9.16.44-2
There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All...
SUSE-RU-2019:2627-1 Recommended update for python-setuptools and dependend packages
All changes necessary for upgrade of python-setuptools to 40.6.2 bsc1075812 New packages: - python-cachetools - python-google-auth - python-packaging Rebuilt without source changes: - python-cffi - python-cliff - python-mock - python-oauthlib - python-pbr - python-PyJWT - python-pytest Added...
CVE-2019-3688
The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain...
Amazon Linux AMI : mysql57 (ALAS-2019-1297)
A stack-based buffer overflow vulnerability in the 'Server: Packaging cURL' subcomponent could allow an unauthenticated attacker to gain complete control of an affected instance of MySQL Server. CVE-2019-3822 Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: XML...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Installation Manager and IBM Packaging Utility
Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7 and 8 used by IBM Installation Manager and IBM Packaging Utility. The IBM Installation Manager and IBM Packaging Utility have addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-4473...
