UVI-2021-1000724 pid: take a reference when initializing `cad_pid`

pid: take a reference when initializing cadpid This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.272 by commit...

UVI-2021-1000722 net: caif: fix memory leak in cfusbl_device_notify

net: caif: fix memory leak in cfusbldevicenotify This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.272 by commit...

UVI-2021-1000721 net: caif: fix memory leak in caif_device_notify

net: caif: fix memory leak in caifdevicenotify This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.272 by commit...

UVI-2021-1000720 net: caif: add proper error handling

net: caif: add proper error handling This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.272 by commit 4f6da6c526a0bf470536b59fdb219d11336e390e...

UVI-2021-1000716 pid: take a reference when initializing `cad_pid`

pid: take a reference when initializing cadpid This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.4.272 by commit...

GSD-2021-1000713 net: caif: fix memory leak in caif_device_notify

net: caif: fix memory leak in caifdevicenotify This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.4.272 by commit...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write. A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds write in function DJVU::filterbv via crafted djvu file may lead to application crash and other consequences. Remediation A fix was pushed into the...

Race condition

When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox 88.0.1 and Firefox for Android 88.1.3...

Denial of Service (DoS)

Overview bindata is a BinData is a declarative way to read and write binary file formats. This means the programmer specifies what the format of the binary data is, and BinData works out how to read and write data in this format. It is an easier and more readable alternative to ruby's pack and...

CVE-2021-32823 Potential Denial-of-Service in bindata

In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit. In combination with...

SUSE-SU-2021:2123-1 Security update for dovecot23

This update for dovecot23 fixes the following issues: - CVE-2021-29157: Local attacker can login as any user and access their emails bsc1187418 - CVE-2021-33515: Attacker can potentially steal user credentials and mails bsc1187419...

Threat Source newsletter (June 17, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. Although the Colonial Pipeline attack is largely behind us now, its potential repercussions are not. This was just the latest in a string of attacks against American critical infrastructure over the past few years, and we... This i...

CVE-2021-24489

A potential security vulnerability in some Intel® Virtualization Technology for Directed I/0 VT-d products may allow escalation of privilege. Bugs Notes Author| Note ---|--- mdeslaur | INTEL-SA-00442...

Lucee Detection (HTTP)

HTTP based detection of Lucee. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.146114";...

SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2020:14548-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14548-1 advisory. - Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption vi...

CVE-2021-33393

lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the...

Adobe Creative Cloud Desktop Application Arbitrary File System Write Vulnerability

Adobe Creative Cloud Desktop Application is the management software for various Creative Cloud applications and services. An arbitrary file system write vulnerability exists in Adobe Creative Cloud Desktop Application 2.4 and earlier versions. The vulnerability originates from the creation of...

SUSE: Security Advisory (SUSE-SU-2021:1438-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2016:1785-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:1553-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...