Huawei EulerOS: Security Advisory for glibc (EulerOS-SA-2021-1382)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization for ARM 64 3.0.6.0 : lua (EulerOS-SA-2021-1545)

According to the version of the lua packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by...

Genua GenuGate High Resistance Firewall Authentication Bypass Vulnerability

Genua GenuGate High Resistance Firewall versions prior to 10.1 p4, 9.6 p7, and 9.0 Z p19 suffer from an authentication bypass vulnerability. ======================================================================= title: Authentication bypass vulnerability product: Genua GenuGate High Resistance...

Fedora 32 : libmysofa (2021-4e40ccb5e6)

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-4e40ccb5e6 advisory. - Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and...

Lazarus targets defense industry with ThreatNeedle

Lazarus targets defense industry with ThreatNeedle PDF We named Lazarus the most active group of 2020. Weve observed numerous activities by this notorious APT group targeting various industries. The group has changed target depending on the primary objective. Google TAG has recently published a...

Fedora 32 : radare2 (2021-e3c95619c1)

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-e3c95619c1 advisory. - radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parsetypedef in typedwarf.c via a malformed DWATnam...

Rockwell Automation Logix Controllers (Update A)

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Rockwell Automation Equipment: Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers Vulnerability: Insufficiently Protected Credentials 2. UPDATE INFORMATION This updated advisory is a...

Oracle Linux 7 : xterm (ELSA-2021-0617)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-0617 advisory. - Backport security fix for CVE-2021-27135 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

EulerOS 2.0 SP2 : gdb (EulerOS-SA-2021-1296)

According to the versions of the gdb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service segmentation fault and crash via a crafted binary,...

Important: glibc

Issue Overview: The iconv program in the GNU C Library aka glibc or libc6 2.31 and earlier, when invoked with multiple suffixes in the destination encoding TRANSLATE or IGNORE along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial...

SolarWinds Hack and the Case of DNS Security

It's not news that some of the top government agencies and companies in the world were victims of the SolarWinds attack. At this point, I can say it's the reason I didn't have a smoother transition back into work-life following a long vacation. As I understand it, the breaches happened after...

Denial Of Service (DoS)

xterm is vulnerable to denial of service. A remote attacker is able to crash the application via a segmentation fault using a malicious UTF-8 character sequence...

CVE-2021-27135

xterm before Patch 366 allows remote attackers to execute arbitrary code or cause a denial of service segmentation fault via a crafted UTF-8 combining character sequence...

CVE-2021-27135

CVE-2021-27135 affects the xterm terminal emulator. A crafted sequence of combining UTF-8 characters can cause an out-of-bounds write, potentially enabling arbitrary code execution or denial of service. Affected versions include xterm prior to the patch/fix; multiple vendor advisories note a fix ...

CVE-2021-27135

xterm before Patch 366 allows remote attackers to execute arbitrary code or cause a denial of service segmentation fault via a crafted UTF-8 combining character sequence...

Arbitrary Code Execution

libmysofa.so is vulnerable to arbitrary code execution. The heap-based buffer overflow caused by a segmentation fault in loudness in libmysofa/src/hrtf/tools.c allows arbitrary code execution through access to unallocated memory block...

libmysofa null pointer dereference vulnerability (CNVD-2021-11056)

libmysofa is a lightweight C library for reading AES SOFA files. A null pointer dereference vulnerability exists in libmysofa 0.5 - 1.1. The vulnerability stems from the changeAttribute function failing to handle input data correctly. An attacker can exploit the vulnerability to cause segmentatio...

libmysofa null pointer dereference vulnerability (CNVD-2021-11057)

libmysofa is a lightweight C library for reading AES SOFA files. A null pointer dereference vulnerability exists in libmysofa 0.5 - 1.1. The vulnerability stems from the verifyAttribute function failing to properly handle input data. An attacker can exploit the vulnerability to cause segmentation...

CVE-2020-36148

Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions e.g. in embedded environment...

DEBIAN-CVE-2020-36149

Incorrect handling of input data in changeAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions e.g. in embedded environment...