Debian DLA-2536-1 : libsdl2 security update

Several issues have been found in libsdl2, a library for portable low level access to a video framebuffer, audio output, mouse, and keyboard. All issues are related to either buffer overflow, integer overflow or heap-based buffer over-read, resulting in a DoS or remote code execution by using...

CentOS 8 : edk2 (CESA-2019:0968)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:0968 advisory. - edk2: Buffer Overflow in BlockIo service for RAM disk CVE-2018-12180 Note that Nessus has not tested for this issue but has instead relied only on the...

Debian DLA-2534-1 : sudo security update

The Qualys Research Labs discovered a heap-based buffer overflow vulnerability in sudo, a program designed to provide limited super user privileges to specific users. Any local user sudoers and non-sudoers can exploit this flaw for root privilege escalation. For Debian 9 stretch, this problem has...

SUSE SLED15 / SLES15 Security Update : sudo (SUSE-SU-2021:0227-1)

This update for sudo fixes the following issues : A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges bsc1181090,CVE-2021-3156 It was possible for a user to test for the existence of a directory due to a Race Condition in sudoedit...

Debian DLA-2532-1 : debian-security-support security update

debian-security-support, the Debian security support coverage checker, has been updated in stretch-security to mark the end of life of the reel package. See https://lists.debian.org/debian-lts/2021/01/msg00016.html for further information. For Debian 9 stretch, this problem has been documented in...

Debian DLA-2531-1 : python-bottle security update

The package src:python-bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon ;, they can cause a difference in the interpretation of the request between the proxy running with...

openSUSE Security Update : slurm_18_08 (openSUSE-2020-2286)

This update for slurm1808 fixes the following issues : Security issues fixed : - CVE-2020-27745: Fixed a potential buffer overflow from use of unpackmem bsc1178890. - CVE-2020-27746: Fixed a potential leak of the magic cookie when sent as an argument to the xauth command bsc1178891. This update w...

EulerOS 2.0 SP3 : python-ipaddress (EulerOS-SA-2021-1115)

According to the version of the python-ipaddress package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow...

EulerOS 2.0 SP3 : squid (EulerOS-SA-2021-1123)

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack c...

EulerOS 2.0 SP3 : iscsi-initiator-utils (EulerOS-SA-2021-1076)

According to the versions of the iscsi-initiator-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack component when...

SUSE SLES12 Security Update : dnsmasq (SUSE-SU-2021:0166-1)

This update for dnsmasq fixes the following issues : bsc1177077: Fixed DNSpooq vulnerabilities CVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed multiple Cache Poisoning attacks. CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687: Fixed multiple potential Heap-based overflows when...

SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0133-1)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-28374: Fixed a LIO security issue bsc1178372. CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver bsc1180559...

Solaris 10 (sparc) : 152643-10

SunOS 5.10: Apache 2.4 Patch. Date this patch was last updated by Sun : Jan/18/21 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid145191; scriptversion"1.1";...

Fedora 32 : mingw-openjpeg2 / openjpeg2 (2020-d32853a28d)

This update backports patches for CVE-2020-27841, CVE-2020-27842, CVE-2020-27843, CVE-2020-27845. ---- This update backports patches for CVE-2020-27824 and CVE-2020-27823. ---- Backport patch for CVE-2020-27814. Note that Tenable Network Security has extracted the preceding description block...

SUSE SLED15 / SLES15 Security Update : php7 (SUSE-SU-2021:0124-1)

This update for php7 fixes the following issue : CVE-2020-7071: Fixed an insufficient filter in parseurl that accepted URLs with invalid userinfo bsc1180706. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

Fedora 33 : 1:dia (2020-1fe0e08c8d)

Added upstream patch to avoid infinite loop on filenames with invalid encoding CVE-2019-19451, 1778767 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as...

SUSE SLES12 Security Update : php72 (SUSE-SU-2021:0125-1)

This update for php72 fixes the following issue : CVE-2020-7071: Fixed an insufficient filter in parseurl that accepted URLs with invalid userinfo bsc1180706. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

Fedora 32 : python-lxml (2020-307946cfb6)

This update fixes mXSS security vulnerability due to the use of improper parser CVE-2020-27783 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...

Debian DLA-2522-1 : coturn security update

A flaw was discovered in coturn, a TURN and STUN server for VoIP. By default coturn does not allow peers on the loopback addresses 127.x.x.x and ::1. A remote attacker can bypass the protection via a specially crafted request using a peer address of '0.0.0.0' and trick coturn in relaying to the...

SUSE SLES15 Security Update : kernel (SUSE-SU-2021:0095-1)

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver bsc1180559. CVE-2020-27825: Fixed a race in the traceopen and buffer resi...