EulerOS 2.0 SP2 : spice-vdagent (EulerOS-SA-2021-2452)

According to the versions of the spice-vdagent package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged...

EulerOS 2.0 SP2 : xorg-x11-server (EulerOS-SA-2021-2440)

According to the version of the xorg-x11-server packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in xorg-x11-server. An interger underflow can occur in xserver which can lead to a local privilege escalation. The highes...

EulerOS 2.0 SP2 : ImageMagick (EulerOS-SA-2021-2385)

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage of...

EulerOS 2.0 SP2 : compat-libtiff3 (EulerOS-SA-2021-2360)

According to the versions of the compat-libtiff3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tiflzw.c resulting in DoS or code execution via a crafted bmp...

EulerOS 2.0 SP2 : libwebp (EulerOS-SA-2021-2403)

According to the versions of the libwebp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this...

EulerOS 2.0 SP2 : cairo (EulerOS-SA-2021-2358)

According to the version of the cairo packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to...

EulerOS 2.0 SP2 : rpm (EulerOS-SA-2021-2443)

According to the versions of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to...

EulerOS 2.0 SP2 : slapi-nis (EulerOS-SA-2021-2448)

According to the version of the slapi-nis package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in slapi-nis. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacker to crash t...

EulerOS 2.0 SP2 : samba (EulerOS-SA-2021-2446)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and befo...

EulerOS 2.0 SP2 : libtiff (EulerOS-SA-2021-2400)

According to the version of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An integer overflow flaw was found in libtiff that exists in the tifgetimage.c file. This flaw allows an attacker to inject and execute arbitrary...

CVE-2021-38575

A flaw was found in edk2. Missing checks in the IScsiHexToBin function in NetworkPkg/IScsiDxe lead to a buffer overflow allowing a remote attacker, who can inject himself in the communication between edk2 and the iSCSI target, to write arbitrary data to any address in the edk2 firmware and...

CVE-2021-3744

A flaw was found in the Linux kernel. A memory leak in the ccp-ops crypto driver can allow attackers to cause a denial of service. This vulnerability is similar with the older CVE-2019-18808. The highest threat from this vulnerability is to system availability. Mitigation Mitigation for this issu...

openSUSE 15 Security Update : libtpms (openSUSE-SU-2021:3004-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:3004-1 advisory. - A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by...

Ubuntu 20.04 LTS : Ghostscript vulnerability (USN-5075-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5075-1 advisory. It was discovered that Ghostscript incorrectly handled certain PostScript files. If a user or automated system were tricked into processing a specially crafted...

undertow: special character in query results in server errors

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability...

Oracle Linux 8 : postgresql:10 (ELSA-2021-2361)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-2361 advisory. 10.17-1 - Update to 10.17 Resolves: 1964520 Fix: CVE-2021-32027, CVE-2021-32028 Tenable has extracted the preceding description block directly from the...

Amazon Linux AMI : libwebp (ALAS-2021-1530)

The version of libwebp installed on the remote host is prior to 0.3.0-10.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1530 advisory. A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due ...

CVE-2021-3781

A trivial sandbox enabled with the -dSAFER option escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highes...

Important: libwebp

Issue Overview: A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

kernel: powerpc: KVM guest OS users can cause host OS memory corruption

A flaw was found on the Linux kernel. On the PowerPC platform, the KVM guest allows the OS users to cause host OS memory corruption via rtasargs.nargs. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...