CVE-2019-14099: Buffer Copy without Checking Size of Input

Device misbehavior may be observed when incorrect offset, length or number of buffers is passed by user space in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, MDM9206, MDM9207C...

Kernel: vfio: access to disabled MMIO space of some devices may lead to DoS scenario

A flaw was found in the Linux kernel, where it allows userspace processes, for example, a guest VM, to directly access h/w devices via its VFIO driver modules. The VFIO modules allow users to enable or disable access to the devices' MMIO memory address spaces. If a user attempts to access the...

AMQ: Denial of Service via unrecognized field injection

A flaw was found in AMQ Online before 1.5.2, where injecting an invalid field to a user's address space configuration of the user namespace puts AMQ Online in an inconsistent state. In this inconsistent state, the AMQ Online components do not operate properly. For example, the failure of...

Moderate: Red Hat Bug Fix Advisory: Advanced Virtualization bug fix and enhancement update

The updated Advanced Virtualization module is now available for Red Hat Enterprise Linux 8.2.1 Advanced Virtualization. The Advanced Virtualization module provides the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. This update fixes a...

OSV-2020-1503 Use-of-uninitialized-value in clip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22181 Crash type: Use-of-uninitialized-value Crash state: clip OpYCbCr420toRGB8bit::convertcolorspace heif::ColorConversionPipeline::convertimage...

USN-4439-1: Linux kernel vulnerabilities

It was discovered that the network block device nbd implementation in the Linux kernel did not properly check for error conditions in some situations. An attacker could possibly use this to cause a denial of service system crash. CVE-2019-16089 It was discovered that the btrfs file system...

Security Bulletin: IBM API Connect V5 is vulnerable to denial of service (PHP CVE-2019-11048)

Summary IBM API Connect had addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-11048 DESCRIPTION: PHP is vulnerable to a denial of service, caused by a flaw in the php-src/main/rfc1867.c. By uploading a specially crafted file, a remote attacker could exploit this...

Unspecified Vulnerability in Juniper Networks Junos Space and Security Director

Juniper Networks Junos Space and Junos Space Security Director are both products of Juniper Networks, U.S.A. Juniper Networks Junos Space is a network management solution. The solution supports automated configuration, monitoring, and troubleshooting of devices and services throughout their...

Russia Tested a Space Weapon Last Week

Twitter hack details, a botnet vigilante, and more of the week's top security news...

IceWarp Email Server File Upload Vulnerability (CNVD-2020-46560)

IceWarp Email Server is a commercial email and groupware server developed by IceWarp. A file upload vulnerability exists in IceWarp Email Server 12.3.0.1, which can be exploited by an attacker to upload files and consume disk space...

Product update: Virtuozzo 6.0 Update 12 Hotfix 53 (6.0.12-3760)

This update provides a stability fix. Vulnerability id: PSBM-104691 Disk space consumption could grow unconditionally during vzfs to ploop conversion...

CVE-2020-8557

The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral...

CVE-2020-8557

The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral...

Code injection

The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral...

CVE-2020-8557

The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral...

CVE-2020-8557

The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral...

Uncontrolled Resource Consumption

The Kubernetes kubelet component do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of dat...

CVE-2020-8557: Uncontrolled Resource Consumption

The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-4425-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4425-1 advisory. It was discovered that the network block device nbd implementation in the Linux kernel did not properly check for error conditions in some...

Kernel: vfio: access to disabled MMIO space of some devices may lead to DoS scenario

A flaw was found in the Linux kernel, where it allows userspace processes, for example, a guest VM, to directly access h/w devices via its VFIO driver modules. The VFIO modules allow users to enable or disable access to the devices' MMIO memory address spaces. If a user attempts to access the...