EulerOS Virtualization 3.0.2.2 : grub2 (EulerOS-SA-2021-2126)

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in grub2. The rmmod implementation allows the unloading of a module used as a dependency without checking if any...

CVE-2021-3570

A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiali...

MGASA-2021-0311 Updated file-roller packages fix security vulnerability

Updated file-roller package fixes security vulnerability: A path traversal vulnerability was found in file-roller due to an incomplete fix for CVE-2020-11736. It may still be possible to extract files outside of the intended directory in case of malicious archives containing symbolic links. The...

MGASA-2021-0309 Updated networkmanager packages fix security vulnerability

A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this vulnerability is to system availability. CVE-2021-20297...

Updated networkmanager packages fix security vulnerability

A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this vulnerability is to system availability. CVE-2021-20297...

Updated file-roller packages fix security vulnerability

Updated file-roller package fixes security vulnerability: A path traversal vulnerability was found in file-roller due to an incomplete fix for CVE-2020-11736. It may still be possible to extract files outside of the intended directory in case of malicious archives containing symbolic links. The...

Debian DLA-2701-1 : openexr - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2701 advisory. - A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can...

CVE-2021-21704

Several flaws has been found in php. The pdofirebase module does not check the length of the server version string in a response packet causing a stack buffer overflow, does not verify the data and uses the wrong type to cast length leading to a crash, and does not validate the response before...

Advisory ROSA-SA-2021-1970

Software: slapi-nis 0.56.5 OS: Cobalt 7.9 CVE-ID: CVE-2021-3480 CVE-Crit: HIGH CVE-DESC: A bug was discovered in slapi-nis in versions before 0.56.7. Dereferencing a null pointer during Binding DN parsing could allow an unauthenticated attacker to take down a 389-ds-base directory server. The...

Advisory ROSA-SA-2021-1963

Software: rpm 4.11.3 OS: Cobalt 7.9 CVE-ID: CVE-2017-7501 CVE-Crit: HIGH CVE-DESC: It was discovered that rpm versions prior to 4.13.0.2 use temporary files with predictable names when installing RPM. An attacker with the ability to write to the directory where the files will be installed could...

Advisory ROSA-SA-2021-1878

Software: libmicrohttpd 0.9.33 OS: Cobalt 7.9 CVE-ID: CVE-2021-3466 CVE-Crit: CRITICAL CVE-DESC: A bug was found in libmicrohttpd in versions before 0.9.71. The lack of bounds checking in the postprocessurlencoded function causes a buffer overflow, allowing a remote attacker to write arbitrary da...

Advisory ROSA-SA-2021-1853

Software: hivex 1.3.10 OS: Cobalt 7.9 CVE-ID: CVE-2014-9273 CVE-Crit: HIGH CVE-DESC: lib / handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges using small bush files, which triggers reads or writes outside the allowed range. CVE-STATUS: default CVE-REV...

Advisory ROSA-SA-2021-1849

Software: grub2 2.02 OS: Cobalt 7.9 CVE-ID: CVE-2020-15706 CVE-Crit: MEDIUM CVE-DESC: GRUB2 contains a race condition in grubscriptfunctioncreate leading to a post-release exploitation vulnerability that can be triggered by overriding a function when the same function is already executing, leadin...

EulerOS Virtualization for ARM 64 3.0.2.0 : wpa_supplicant (EulerOS-SA-2021-2105)

According to the version of the wpasupplicant package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A flaw was found in the wpasupplicant, in the way it processes P2P Wi-Fi Direct provision discovery requests. This...

EulerOS Virtualization for ARM 64 3.0.2.0 : libtiff (EulerOS-SA-2021-2119)

According to the versions of the libtiff package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new...

EulerOS Virtualization for ARM 64 3.0.2.0 : libwebp (EulerOS-SA-2021-2104)

According to the versions of the libwebp package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in libwebp. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this...

Medium: libxml2

Issue Overview: There's a flaw in libxml2's xmllint. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability. CVE-2021-3516 There's a flaw in libxml2. An attacke...

Medium: httpd

Issue Overview: A flaw was found in Apache httpd. The modproxywstunnel module tunnels non-upgraded connections. CVE-2019-17567 A flaw was found in HTTPd. In some Apache HTTP Server versions, unprivileged local users can stop HTTPd on Windows. The highest threat from this vulnerability is to syste...

EulerOS Virtualization for ARM 64 3.0.2.0 : cairo (EulerOS-SA-2021-2095)

According to the versions of the cairo packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in cairo 1.16.0. There is an infinite loop in the function arcerrornormalized in the file...

Important: libwebp

Issue Overview: A flaw was found in libwebp. A heap-based buffer overflow was found in PutLE16. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2018-25011 A flaw was found in libwebp in versions before 1.0.1. A heap-based...