Virtuozzo Linux Errata and Bugfix Advisory 2019:3077

Upstream security update. Follow RHBA-2019:3077 for details...

Security Bulletin: Public disclosed vulnerability from OpenSSL and OpenSSH affects IBM Netezza Host Management

Summary Open Source OpenSSL and OpenSSH is used by IBM Netezza Host Management. IBM Netezza Host Management has addressed the applicable CVEs. OpenSSL and OpenSSH rpms from RedHat are included in IBM Netezza Host Management for RHEL 6. Vulnerability Details OpenSSH : CVEID: CVE-2016-6210...

Security Bulletin: IBM Netezza Host Management NTP vulnerabilities (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, CVE-2014-9296)

Summary Multiple vulnerabilities were found in the Linux NTP component. RedHat released a patch to address these vulnerabilities. Vulnerability Details CVEID: CVE-2014-9293 DESCRIPTION: Network Time Protocol NTP Project NTP daemon ntpd could provide weaker than expected security, caused by the...

Security Bulletin: IBM Netezza Host Management (CVE-2014-5119)

Summary Proof of Concept exploit code has been released on August 25th, which uses a flaw in glibc that can allow a local unprivileged user to gain root on Linux machines. Vulnerability Details CVEID: CVE-2014-5119 DESCRIPTION: Proof of Concept exploit code has been released on August 25th, which...

RHEL 6 : java-1.8.0-openjdk (RHSA-2019:3136)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3136 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

RHEL 7 : java-1.8.0-openjdk (RHSA-2019:3128)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3128 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

RHEL 7 : kernel-rt (RHSA-2019:3089)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3089 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

RHEL 7 : kpatch-patch (RHSA-2019:3076)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3076 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel...

SQLite CVE-2019-8457 Out of Bounds Read Heap Buffer Overflow Vulnerability

Description SQLite is prone to a remote heap-based buffer-overflow vulnerability. Attackers can exploit this issue to crash the application, resulting in a denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed...

Podman / Varlink Remote Code Execution

!/usr/bin/python -- coding: UTF-8 -- pickletime.py Podman + Varlink Insecure Config Remote Exploit Jeremy Brown jbrown3264/gmail @ Oct 2019 ------- Details ------- Podman is container engine / platform similar to Docker supported by RedHat and Fedora with Varlink being a protocol to exchange...

Podman Varlink 1.5.1 - Remote Code Execution

Podman Varlink 1.5.1 - Remote Code Execution Exploit Title: Podman & Varlink 1.5.1 - Remote Code Execution Exploit Author: Jeremy Brown Date: 2019-10-15 Vendor Homepage: https://podman.io/ Software Link: dnf install podman or https://github.com/containers/libpod/releases Version: 1.5.1 Tested on:...

Oracle Java SE/Java SE Embedded CVE-2019-2989 Remote Security Vulnerability

Description Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. The vulnerability can be exploited over Multiple protocols. This issue affects the 'Networking' component. This vulnerability affects the following supported versions: Java SE: 7u231, 8u221, 11.0.4, 13;...

Podman & Varlink 1.5.1 - Remote Code Execution Exploit

Exploit Title: Podman & Varlink 1.5.1 - Remote Code Execution Exploit Author: Jeremy Brown Date: 2019-10-15 Vendor Homepage: https://podman.io/ Software Link: dnf install podman or https://github.com/containers/libpod/releases Version: 1.5.1 Tested on: Fedora Server 30 !/usr/bin/python -- coding:...

CVE-2018-15911

It was discovered that ghostscript did not properly verify the key used in aesdecode. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document...

FasterXML Jackson-databind CVE-2019-17531 Remote Code Execution Vulnerability

Description FasterXML Jackson-databind is prone to a remote-code execution vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions. FasterXML jackson-databi...

Ansible CVE-2019-14858 Information Disclosure Vulnerability

Description Ansible is prone to an information-disclosure vulnerability. Successfully exploiting this issue may allow an attacker to obtain sensitive information that may aid in further attacks. Versions prior to Ansible 2.6.20, 2.7.14, 2.8.6 and 2.9.0rc4 are vulnerable. Technologies Affected...

Redhat Wildfly Core CVE-2019-14838 Privilege Escalation Vulnerability

Description Redhat Wildfly is prone to a privilege-escalation. A remote attacker can exploit this issue to gain elevated privileges on an affected device. Technologies Affected Redhat JBoss Data Grid 7 Redhat JBoss Enterprise Application Platform 7.0 Redhat Single Sign-On 7.0 Redhat WildFly Core...

RHEL 7 : wget (RHSA-2019:2979)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:2979 advisory. The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: doconversion heap-based buffe...

Redhat OpenShift Container Platform CVE-2019-14854 Information Disclosure Vulnerability

Description Redhat OpenShift Container Platform is prone to an information-disclosure vulnerability. Successful exploits may allow the attacker to obtain sensitive information. This may lead to other attacks. OpenShift Container Platform 4.1 and 4.2 are vulnerable. Technologies Affected Redhat...

RHEL 7 : patch (RHSA-2019:2964)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2964 advisory. The patch program applies diff files to originals. The diff command is used to compare an original to a changed file. Diff lists the changes...