SUSE-SU-2020:3901-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.6.0 ESR Fixed: Various stability, functionality, and security fixes MFSA 2020-55 bsc1180039 CVE-2020-16042 bmo1679003 Operations on a BigInt could have caused uninitialized memory to be exposed...

Pulse Secure VPN Remote Code Execution Exploit

The Pulse Connect Secure appliance versions prior to 9.1R9 suffer from an uncontrolled gzip extraction vulnerability which allows an attacker to overwrite arbitrary files, resulting in remote code execution as root. Admin credentials are required for successful exploitation...

Security Bulletin: IBM Cloud Functions web actions API endpoint change

Summary In order to improve the stability of the service and to prevent potential weaknesses in the services' web actions functionality we introduced a new IBM Cloud Functions API endpoint .functions.appdomain.cloud for web actions which use text/html response data. The previously used API endpoi...

Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow Exploit

This Metasploit module exploits a stack-based buffer overflow in the Solaris PAM library's username parsing code, as used by the SunSSH daemon when the keyboard-interactive authentication method is specified. Tested against SunSSH 1.1.5 on Solaris 10u11 1/13 x86 in VirtualBox, VMware Fusion, and...

SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:3053-1)

This update for MozillaFirefox fixes the following issues : Firefox Extended Support Release 78.4.0 ESR - Fixed: Various stability, functionality, and security fixes MFSA 2020-46 bsc1177872, bsc1176756 - CVE-2020-15969 Use-after-free in usersctp - CVE-2020-15683 Memory safety bugs fixed in Firefo...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:3021-1)

This update for MozillaFirefox fixes the following issues : Firefox Extended Support Release 78.4.0 ESR - Fixed: Various stability, functionality, and security fixes MFSA 2020-46 bsc1177872, bsc1176756 - CVE-2020-15969 Use-after-free in usersctp - CVE-2020-15683 Memory safety bugs fixed in Firefo...

Security Update Guide: Let’s keep the conversation going

Hi Folks, We want to continue to highlight changes we’ve made to our Security Update Guide. We have received a lot of feedback, much of which has been very positive. We acknowledge there have been some stability problems and we are actively working through reports of older browsers not being able...

Security Update Guide: Let's keep the conversation going

Hi Folks, We want to continue to highlight changes we’ve made to our Security Update Guide. We have received a lot of feedback, much of which has been very positive. We acknowledge there have been some stability problems and we are actively working through reports of older browsers not being able...

Security Update Guide: Let's keep the conversation going

Hi Folks, We want to continue to highlight changes we’ve made to our Security Update Guide. We have received a lot of feedback, much of which has been very positive. We acknowledge there have been some stability problems and we are actively working through reports of older browsers not being able...

Product update: Virtuozzo Hybrid Server 7.5 Hotfix 1 (7.5.0-589)

The Hotfix 1 for Virtuozzo Hybrid Server 7.5 provides stability and usability bug fixes. Vulnerability id: PSBM-108125 Virtuozzo Storage trial licenses ending in 2021 could be reported as invalid. Vulnerability id: PSBM-123396 Migrating a VM over Virtuozzo Storage could take a very long time...

Kernel update: Virtuozzo ReadyKernel patch 119.5 for Virtuozzo Hybrid Server 7.5

The cumulative Virtuozzo ReadyKernel patch was updated with a stability fix. The patch applies to the kernel 3.10.0-1127.18.2.vz7.163.46 Virtuozzo Hybrid Server 7.5. Vulnerability id: PSBM-123085 Kernel crash due to an incorrect BUGON assertion in movefreepages...

Kernel update: Virtuozzo ReadyKernel patch 119.5 for Virtuozzo Hybrid Server 7.0 and Virtuozzo Hybrid Infrastructure 4.0

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to the kernels 3.10.0-1127.8.2.vz7.151.14 Virtuozzo Hybrid Server 7.0.14, 3.10.0-1127.8.2.vz7.158.8 Virtuozzo Hybrid Infrastructure 4.0. Vulnerability id: PSBM-122035 3.10.0-1127.8.2.vz7.151.14 to...

Kernel update: Virtuozzo ReadyKernel patch 119.0 for Virtuozzo Hybrid Server 7.0, Virtuozzo Infrastructure Platform 3.0, and Virtuozzo Hybrid Infrastructure 3.5

The cumulative Virtuozzo ReadyKernel patch was updated with a stability fix. The patch applies to the kernels 3.10.0-957.10.1.vz7.85.17 Virtuozzo Hybrid Server 7.0.10, 3.10.0-957.12.2.vz7.86.2 Virtuozzo Hybrid Server 7.0.10 HF1, 3.10.0-957.12.2.vz7.96.21 Virtuozzo Hybrid Server 7.0.11 and Virtuoz...

openSUSE Security Update : the Linux Kernel (openSUSE-2020-2112)

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' bsc1177724. - CVE-2020-24490: Fixed a heap buffer overflow when...

Apache NiFi API Remote Code Execution Exploit

This Metasploit module uses the NiFi API to create an ExecuteProcess processor that will execute OS commands. The API must be unsecured or credentials provided and the ExecuteProcess processor must be available. An ExecuteProcessor processor is created then is configured with the payload and...

OPENSUSE-SU-2020:2035-1 Security update for rclone

This update for rclone fixes the following issues: rclone was updated to version 1.53.3: Bug Fixes - Fix incorrect use of math/rand instead of crypto/rand CVE-2020-28924 boo1179005 Nick Craig-Wood - Check https://github.com/rclone/passwordcheck for a tool check for weak passwords generated by...

Security update for rclone (moderate)

openSUSE Security Update: Security update for rclone Announcement ID: openSUSE-SU-2020:2008-1 Rating: moderate References: 1179005 Cross-References: CVE-2020-28924 Affected Products: openSUSE Leap 15.2 An update that fixes one vulnerability is now available. Description: This update for rclone...

SUSE-SU-2020:3474-1 Security update for u-boot

This update for u-boot fixes the following issues: Work around CVE-2019-11059 by disabling 64Bit descritptor size bsc1134853 CVE-2019-11690 bsc1134157, CVE-2020-10648 bsc1167209, CVE-2019-13103 bsc1143463, CVE-2019-14197 bsc1143821, CVE-2019-14200 bsc1143825, CVE-2019-14201 bsc1143827,...

Hotfix XS82E007 - For Citrix Hypervisor 8.2

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.2. This hotfix supersedesHotfix XS82E005. All customers who are affected by the issues described inCTX282314 - Citrix Hypervisor Multiple Security Updatesshould install this hotfix. Information About this...

Oracle WebLogic Server Administration Console Handle Remote Code Execution Exploit

This Metasploit module exploits a path traversal and a Java class instantiation in the handle implementation of WebLogic's Administration Console to execute code as the WebLogic user. Versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 are known to be affected. Tested against...