CVE-2020-27815

CVE-2020-27815 is a vulnerability in the Linux kernel JFS filesystem code allowing a local attacker who can set extended attributes to trigger a system panic, memory corruption, or privilege escalation. Publicly documented impact: confidentiality, integrity, and availability may be affected. The ...

CVE-2021-23017

A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote code execution in...

CVE-2021-3549: Improper Restriction of Operations within the Bounds of a Memory Buffer

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avrelf32loadrecordsfromsection probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as...

Oracle Linux 8 : spice-vdagent (ELSA-2021-1791)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-1791 advisory. 0.20.0-3 - Fix mouse problems in multi-monitor environments under Wayland Resolves: rhbz1790904 rhbz1824610 0.20.0-2 - Resolves: CVE-2020-25650,...

CVE-2021-20297: Improper Input Validation

A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this vulnerability is to system availability...

Oracle Linux 8 : userspace / graphics, / xorg-x11, / and / mesa (ELSA-2021-1804)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1804 advisory. - Fix CVE-2020-14363 1873923 mesa - CVE fix for: CVE-2020-14347 1862320 - CVE fixes for: CVE-2020-14345 1872391, CVE-2020-14346 1872395, CVE-2020-14361...

kernel: Integer overflow in Intel(R) Graphics Drivers

A flaw was found in the Linux kernel. An integer overflow in the firmware for some IntelR Graphics Drivers may allow a privileged user to potentially enable an escalation of privilege via local access. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

kernel: Use after free via PI futex state

A flaw was found in the Linux kernel. A use-after-free memory flaw in the Fast Userspace Mutexes functionality allowing a local user to crash the system or escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as syste...

CVE-2020-28407

A flaw was found in swtpm. This flaw allows an attacker to create a symbolic link with the name of the temporary file TMP2-00.permall for TPM 2 and have this point to a valuable file, which will get overwritten by swtpm. The success of the attack depends on the attacker having access to the TPM's...

A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

...

kernel: Use after free via PI futex state

A flaw was found in the Linux kernel. A use-after-free memory flaw in the Fast Userspace Mutexes functionality allowing a local user to crash the system or escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as syste...

PT-2021-3340 · 3S Smart Software Solutions · Codesys V2 Runtime System

Name of the Vulnerable Software and Affected Versions: CODESYS V2 runtime system SP versions prior to 2.4.7.55 Description: The issue arises from the improper neutralization of special elements used in an OS command, potentially allowing an attacker to impact the confidentiality, integrity, and...

runc: vulnerable to symlink exchange attack

The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuous container configuration that results in the host filesystem being bind-mounted into the container. The highest threat from this vulnerability is to data confidentiality and integrity ...

CVE-2021-3559

A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts with a PCI device and driver that supports mediated devices e.g., GRID driver. This flaw could be used by an unprivileged client with a read-only connection to crash the libvirt...

Command injection

A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts with a PCI device and driver that supports mediated devices e.g., GRID driver. This flaw could be used by an unprivileged client with a read-only connection to crash the libvirt...

CVE-2021-3559

A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts with a PCI device and driver that supports mediated devices e.g., GRID driver. This flaw could be used by an unprivileged client with a read-only connection to crash the libvirt...

CVE-2021-3559

A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts with a PCI device and driver that supports mediated devices e.g., GRID driver. This flaw could be used by an unprivileged client with a read-only connection to crash the libvirt...

CVE-2021-3559

CVE-2021-3559 : A flaw in libvirt’s virConnectListAllNodeDevices API affects hosts with PCI devices using mediated devices (e.g., GRID driver) and libvirt versions before 7.0.0. An unprivileged client with a read-only connection can crash the libvirt daemon by executing the nodedev-list command, ...

Medium: spamassassin

Issue Overview: A flaw was found in spamassassin. Malicious rule configuration .cf files can be configured to run system commands without any output or errors allowing exploits to be injected in a number of scenarios. The highest threat from this vulnerability is to data confidentiality and...

Libwebp Uninitialized Variable Usage Vulnerability

Libwebp is a WebP image format encoding and decoding library . A security vulnerability exists in versions of Libwebp prior to 1.0.1. The vulnerability stems from the use of a single variable in the ReadSymbol function. An attacker could exploit the vulnerability to threaten data confidentiality...