Medium: kernel-livepatch-4.14.165-133.209

Issue Overview: In the Linux kernel before 5.5.8, getrawsocket in drivers/vhost/net.c lacks validation of an skfamily field, which might allow attackers to trigger kernel stack corruption via crafted system calls. CVE-2020-10942 Affected Packages: kernel-livepatch-4.14.165-133.209 Issue Correctio...

Deserialization of Untrusted Data

Overview activesupport is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the MemCacheStore and RedisCacheStore. when untrusted user input is written to the cache...

CVE-2020-12753

An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Arbitrary code execution can occur via the bootloader because of an EL1/EL3 coldboot vulnerability involving rawresources. The LG ID is LVE-SMP-200006 May 2020...

Node.js: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests

Summary: Node.js is vulnerable to HTTP denial of service DOS attacks based on delayed requests submission which can make the server unable to accept new connections. Description: An attacker can open an arbitrary number of HTTP connections and keep the server busy by never completing the request...

DRUPAL-CONTRIB-2020-013

The Webform module allows site builders to create forms. The module doesn't sufficiently prevent malicious code from being render via an options elements i.e select menu, checkboxes, radios, etc... under the scenario where the site builder allows the raw option value to be displayed. This...

kernel: unprivileged users able to create RAW sockets in AF_ISDN network protocol

A vulnerability was found in the Linux kernel’s implementation of the AFISDN protocol, which does not enforce the CAPNETRAW capability. This flaw can allow unprivileged users to create a raw socket for this protocol. This could further allow the user to control the availability of an existing ISD...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: unprivileged users able to create RAW sockets in AF_IEEE802154 network protocol

A vulnerability was discovered in the Linux kernel's AFIEEE802154 networking module where permissions checks are not enforced. This can allow an unprivileged user to create raw sockets for this protocol leading to the potential for data leaks or system unavailability...

kernel: unprivileged users able to create RAW sockets in AF_ISDN network protocol

A vulnerability was found in the Linux kernel’s implementation of the AFISDN protocol, which does not enforce the CAPNETRAW capability. This flaw can allow unprivileged users to create a raw socket for this protocol. This could further allow the user to control the availability of an existing ISD...

kernel: unprivileged users able to create RAW sockets in AF_IEEE802154 network protocol

A vulnerability was discovered in the Linux kernel's AFIEEE802154 networking module where permissions checks are not enforced. This can allow an unprivileged user to create raw sockets for this protocol leading to the potential for data leaks or system unavailability...

The vulnerability of the unpacked_load_raw() function in the LibRaw image processing library allows a attacker to cause a service failure.

The vulnerability of the unpackedloadraw function in dcrawcommon.cpp in the LibRaw image processing library is related to type conversion errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the RAW decoder in the VNC client of the software for controlling remote desktops, UltraVNC, allows a hacker to execute arbitrary code.

The vulnerability of the RAW decoder in the VNC client of the remote desktop management software UltraVNC is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2020-7958

An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user root in the Rich Execution Environment REE to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the...

Authorization Bypass

kernel is vulnerable to authorization bypass. In KVM Kernel-based Virtual Machine environments using raw format virtio disks backed by a partition or LVM volume, a privileged guest user could bypass intended restrictions and issue read and write requests and other SCSI commands on the host, and...

Information Disclosure

xen is vulnerable to information disclosure. The vulnerability exists as a flaw was found in the QEMU block format auto-detection, when running fully-virtualized guests and using Qemu images written on removable media USB storage, 3.5" disks. Privileged users of such fully-virtualized guests DomU...

Information Disclosure

xen is vulnerable to information disclosure. A security vulnerability was discovered in the QEMU block format auto-detection, when running fully-virtualized guests. Such fully-virtualized guests, with a raw formatted disk image, were able to write a header to that disk image describing another...

CVE-2019-17055

A vulnerability was found in the Linux kernel’s implementation of the AFISDN protocol, which does not enforce the CAPNETRAW capability. This flaw can allow unprivileged users to create a raw socket for this protocol. This could further allow the user to control the availability of an existing ISD...

CVE-2019-17053

A vulnerability was discovered in the Linux kernel's AFIEEE802154 networking module where permissions checks are not enforced. This can allow an unprivileged user to create raw sockets for this protocol leading to the potential for data leaks or system unavailability...

CVE-2018-5805

LibRaw is vulnerable to stack-based buffer overflow in internal/dcrawcommon.cpp:quicktake100loadraw function when processing specially-crafted RAW data. An attacker could potentially use this flaw to cause an arbitrary code execution or denial of service...

Design/Logic Flaw

A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via raw objmon configuration files. This issue affects all versions of Junos OS Evolved prior to 19.1R1...