tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become...

Using LL-HLS with Byte-Range Addressing to Achieve Interoperability in Low Latency Streaming

HTTP Adaptive Segmented HAS streaming began to be used at scale from 2008 to 2012, with the advent of Move Networks, Microsoft Smooth Streaming, Apple HLS, Adobe HDS, and MPEG DASH. With the typical 10s segment durations of the day, livestream latencies measuring latency as the time from an actio...

openSUSE Security Update : java-11-openjdk (openSUSE-2020-1984)

"This update for java-11-openjdk fixes the following issues : - Update to upstream tag jdk-11.0.9-11 October 2020 CPU, bsc1177943 - New features + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector - Security fixes + JDK-8233624: Enhance JNI linkage + JDK-8236196: Improve string pooling ...

Hashicorp HashiCorp Consul Security Breach

Hashicorp HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp Hashicorp USA. The product is used to connect and provision applications across a dynamically distributed infrastructure. A security vulnerability exists in HashiCorp Consul and Consu...

Frenchbread Private-ip Code Issue Vulnerability

Frenchbread Private-ip is a Js codebase for checking if an Ip is private by Frenchbread individual developers. A security vulnerability exists in the Frenchbread Private-ip package prior to v1.0.5 that stems from insufficient regular expressions to adequately filter the reserved IP range, resulti...

Pritunl-client Backlink Vulnerability

Pritunl-client is an open source OpenVPN client application from US-based Pritunl. A backlink vulnerability exists in pritunl electron client versions 1.0.1116.6 through v1.2.2550.20, which originates from an arbitrary file write. An attacker can exploit this vulnerability to execute code with ro...

PT-2020-13496 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.14 through 13.3.8 GitLab CE/EE versions 13.4 through 13.4.4 GitLab CE/EE versions 13.5 through 13.5.1 Description: An issue has been discovered in GitLab CE/EE that affects all versions starting from 8.14. A path...

CVE-2020-13351

Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are =13.0, =13.4.0, =13.5.0, 13.5.2...

SUSE-SU-2020:3359-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: - Update to upstream tag jdk-11.0.9-11 October 2020 CPU, bsc1177943 New features + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector Security fixes + JDK-8233624: Enhance JNI linkage + JDK-8236196: Improve string pooling +...

alkyne (0.1.0), dioxus-core (0.1.2) +7 more potentially affected by CVE-2020-36456 via toolshed (>=0.4.0, <=0.8.1)

toolshed CARGO version =0.4.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1 - vip-712 0.1.1 Source cves: CVE-2020-36456 Source advisory: OSV:RUSTSEC-2020-0136...

SUSE-SU-2020:3310-1 Security update for java-1_7_0-openjdk

This update for java-170-openjdk fixes the following issues: - Update to 2.6.24 - OpenJDK 7u281 October 2020 CPU, bsc1177943 Security fixes + JDK-8233624: Enhance JNI linkage + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts +...

PT-2020-16961 · Deephas · Deephas

Name of the Vulnerable Software and Affected Versions: deephas versions 1.0.0 through 1.0.5 Description: The issue allows an attacker to cause a denial of service and may lead to remote code execution due to a prototype pollution vulnerability. Recommendations: For deephas versions 1.0.0 through...

Unbreakable Enterprise kernel-container security update

4.14.35-2025.402.2.1.el7 - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040805 CVE-2020-8694 CVE-2020-8695 4.14.35-2025.402.2.el7 - ocfs2: fix remounting needed after setfacl command Gang He - Fix multiple variable definition with syzkaller Hans Westgaard Ry Orabug:...

Unbreakable Enterprise kernel-container security update

4.14.35-2025.402.2.1.el7 - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040805 CVE-2020-8694 CVE-2020-8695 4.14.35-2025.402.2.el7 - ocfs2: fix remounting needed after setfacl command Gang He - Fix multiple variable definition with syzkaller Hans Westgaard Ry Orabug:...

frr security and bug fix update

7.0-10 - Resolves: 1867793 - FRR does not conform to the source port range specified in RFC5881 7.0-9 - Resolves: 1852476 - default permission issue eases information leaks 7.0-8 - Resolves: 1819319 - frr fails to start start if the initscripts package is missing 7.0-7 - Resolves: 1758544 - IGMPv...

Unbreakable Enterprise kernel security update

5.4.17-2036.100.6.1.el8uek - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040802 CVE-2020-8694 CVE-2020-8695 - KVM: ioapic: break infinite recursion on lazy EOI Vitaly Kuznetsov Orabug: 32066585 CVE-2020-27152 CVE-2020-27152 - x86/mitigations: Restore paranoid checks fo...

PYSEC-2020-26

Synopsys hub-rest-api-python aka blackduck on PyPI version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases...

Micro Focus Self Service Password Reset Information Disclosure Vulnerability

Micro Focus Self Service Password Reset SSPR is a simple, secure, and easy-to-deploy self-service password management tool that helps users reset or re-enable their own network passwords without having to call the help desk. An information disclosure vulnerability exists in Micro Focus Self Servi...

Unbreakable Enterprise kernel security update

4.1.12-124.44.4 - scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS [email protected] Orabug: 32020790 4.1.12-124.44.3 - qed: Reduce verbosity of unimplemented MFW messages Mintz, Yuval Orabug: 31959299 - kexec: validate pe files against the systemblacklistkeyring Eric...

CVE-2020-25662

A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initialization of stack memory when handling certain AMP packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the...