CVE-2020-8022 User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server...

Description of the 2007 Office Servers SP3 and of the 2007 Office Servers Language Pack SP3

Describes the improvements that the 2007 Office Servers SP3 and the 2007 Office Servers Language Pack SP3 provide and the issues that they fix.IntroductionThe 2007 Microsoft Office servers Service Pack 3 SP3 and the 2007 Microsoft Office servers Language Pack SP3 provide the latest updates to the...

EulerOS 2.0 SP3 : git (EulerOS-SA-2020-1386)

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clon...

EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2020-1430)

According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In libslirp 4.1.0, as used in QEMU 4.2.0, tcpsubr.c misuses snprintf return values, leading to a buffer overflow in later code.CVE-2020-8608 -...

EulerOS 2.0 SP3 : libwpd (EulerOS-SA-2020-1407)

According to the version of the libwpd package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a...

EulerOS 2.0 SP3 : libgcrypt (EulerOS-SA-2020-1400)

According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proxima...

EulerOS 2.0 SP3 : ruby (EulerOS-SA-2020-1432)

According to the version of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The openssl gem for Ruby uses the same initialization vector IV in GCM Mode aes--gcm when the IV is set before the key, which makes it easier for...

EulerOS 2.0 SP3 : e2fsprogs (EulerOS-SA-2020-1379)

According to the version of the e2fsprogs packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory ca...

EulerOS 2.0 SP3 : nss-util (EulerOS-SA-2020-1415)

According to the version of the nss-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory a...

EulerOS 2.0 SP3 : cyrus-sasl (EulerOS-SA-2020-1377)

According to the version of the cyrus-sasl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - cyrus-sasl aka Cyrus SASL 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDA...

EulerOS 2.0 SP3 : freetype (EulerOS-SA-2020-1382)

According to the version of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1GetPrivateDict where there is no check that the new values o...

EulerOS 2.0 SP3 : opensc (EulerOS-SA-2020-1417)

According to the versions of the opensc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Several buffer overflows when handling responses from a Muscle Card in musclelistfiles in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 cou...

EulerOS 2.0 SP3 : ppp (EulerOS-SA-2020-1426)

According to the versions of the ppp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eaprequest and eapresponse functions.CVE-2020-8597 - Buffer overflo...

EulerOS 2.0 SP3 : libplist (EulerOS-SA-2020-1404)

According to the version of the libplist package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The parsestringnode function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service memory corruption via a...

EulerOS 2.0 SP3 : icu (EulerOS-SA-2020-1389)

According to the version of the icu packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The International Components for Unicode ICU libraries provide robust and full-featured Unicode services on a wide variety of platforms. ICU supports...

EulerOS 2.0 SP3 : ipmitool (EulerOS-SA-2020-1392)

According to the version of the ipmitool package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may...

EulerOS 2.0 SP3 : curl (EulerOS-SA-2020-1376)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and...

EulerOS 2.0 SP3 : openssl098e (EulerOS-SA-2020-1420)

According to the version of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order...

EulerOS 2.0 SP3 : file (EulerOS-SA-2020-1381)

According to the version of the file packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - cdfreadpropertyinfo in cdf.c in file through 5.37 does not restrict the number of CDFVECTOR elements, which allows a heap-based buffer overflow 4-byt...

EulerOS 2.0 SP3 : tomcat (EulerOS-SA-2020-1438)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections ...