CentOS 8 : edk2 (CESA-2021:4198)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4198 advisory. - openssl: integer overflow in CipherUpdate CVE-2021-23840 - openssl: NULL pointer dereference in X509issuerandserialhash CVE-2021-23841 Note that Ness...

RHEL 8 : pcre (RHSA-2021:4373)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4373 advisory. PCRE is a Perl-compatible regular expression library. Security Fixes: pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has...

CentOS 8 : mutt (CESA-2021:4181)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4181 advisory. - mutt: Incorrect handling of invalid initial IMAP responses could lead to an authentication attempt over unencrypted connection CVE-2020-28896 - mutt:...

RHEL 8 : container-tools:rhel8 (RHSA-2021:4154)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4154 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: buildah:...

CentOS 8 : pcs (CESA-2021:4142)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4142 advisory. - jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2020-11023 - jquery: Cross-site scripting XSS via HTML tags...

RHEL 8 : resource-agents (RHSA-2021:4139)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4139 advisory. The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with severa...

CentOS 8 : container-tools:rhel8 (CESA-2021:4154)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4154 advisory. - containers/storage: DoS via malicious image CVE-2021-20291 - buildah: Host environment variables leaked in build container when using chroot isolatio...

RHEL 8 : ncurses (RHSA-2021:4426)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4426 advisory. The ncurses new curses library routines are a terminal-independent method of updating character screens with reasonable optimization. The...

CentOS 8 : openssl (CESA-2021:4424)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4424 advisory. - openssl: integer overflow in CipherUpdate CVE-2021-23840 - openssl: NULL pointer dereference in X509issuerandserialhash CVE-2021-23841 Note that Ness...

CentOS 8 : autotrace (CESA-2021:4519)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4519 advisory. - autotrace: integer overflow in input-bmp.c CVE-2019-19004 - autotrace: bitmap double free in main.c allows attackers to cause an unspecified impact...

RHEL 8 : babel (RHSA-2021:4201)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4201 advisory. Babel provides tools to build and work with gettext message catalogs, and a Python interface to the CLDR Common Locale Data Repository,...

CentOS 8 : resource-agents (CESA-2021:4139)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4139 advisory. - python-pygments: Infinite loop in SML lexer may lead to DoS CVE-2021-20270 - python-pygments: ReDoS in multiple lexers CVE-2021-27291 Note that Nessu...

CentOS 8 : pcre (CESA-2021:4373)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4373 advisory. - pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 CVE-2019-20838 - pcre: Integer overflow when...

CentOS 8 : glib2 (CESA-2021:4385)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4385 advisory. - glib: gfilereplace with GFILECREATEREPLACEDESTINATION creates empty target for dangling symlink CVE-2021-28153 - glib2: Possible privilege escalation...

Microsoft’s Patch Tuesday Security Updates for November

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. For the month of November, Microsoft has reported a total of 55 vulnerabilities, 6CVE-2021-38666, CVE-2021-26443, CVE-2021-42279, CVE-2021-42298, CVE-2021-42316, CVE-2021-3711 of which have been rated critical. Four...

13 New Flaws in Siemens Nucleus TCP/IP Stack Impact Safety-Critical Equipment

As many as 13 security vulnerabilities have been discovered in the Nucleus TCP/IP stack, a software library now maintained by Siemens and used in three billion operational technology and IoT devices that could allow for remote code execution, denial-of-service DoS, and information leak...

Microsoft Issues Patches for Actively Exploited Excel, Exchange Server 0-Day Bugs

Microsoft has released security updates as part of its monthly Patch Tuesday release cycle to address 55 vulnerabilities across Windows, Azure, Visual Studio, Windows Hyper-V, and Office, including fixes for two actively exploited zero-day flaws in Excel and Exchange Server that could be abused t...

CVE-2021-42321

Microsoft Exchange Server Remote Code Execution Vulnerability Recent assessments: gwillcox-r7 at November 21, 2021 5:55pm UTC reported: A PoC for this vulnerability is now available at https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398. There is also a Metasploit module at...

Vulnerabilities fixed in Adobe products

Vulnerabilities have been fixed in several Adobe products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Remote code execution User Rights Adobe has released updates to fix the...

Microsoft Patch Tuesday, November 2021 Edition

Microsoft Corp. today released updates to quash at least 55 security bugs in its Windows operating systems and other software. Two of the patches address vulnerabilities that are already being used in active attacks online, and four of the flaws were disclosed publicly before today -- potentially...