Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : lxml vulnerability (USN-4666-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4666-1 advisory. It was discovered that lxml incorrectly handled certain HTML. An attacker could possibly use this issue to cross-site scripting XSS attack...

SUSE SLES12 Security Update : php7 (SUSE-SU-2020:2920-1)

This update for php7 fixes the following issues : CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names bsc1177352. Added tmpfiles.d for php-fpm to provide a base for a socket bsc1173786 Note that Tenable Network Security has...

SUSE SLED15 / SLES15 Security Update : u-boot (SUSE-SU-2020:3282-1)

This update for u-boot fixes the following issues : CVE-2019-14192 bsc1143777, CVE-2019-14193 bsc1143817, CVE-2019-14199 bsc1143824, CVE-2019-14197 bsc1143821, CVE-2019-14200 bsc1143825, CVE-2019-14201 bsc1143827, CVE-2019-14202 bsc1143828, CVE-2019-14203 bsc1143830, CVE-2019-14204 bsc1143831,...

SUSE SLED15 / SLES15 Security Update : postgresql12 (SUSE-SU-2020:3463-1)

This update for postgresql12 fixes the following issues : Upgrade to version 12.5 : - CVE-2020-25695, bsc1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. - CVE-2020-25694, bsc1178667: a Fix usage of complex...

SUSE SLES15 Security Update : xorg-x11-server (SUSE-SU-2020:3589-1)

This update for xorg-x11-server fixes the following issues : CVE-2020-25712: Fixed a heap-based buffer overflow which could have led to privilege escalation bsc1177596. CVE-2020-14360: Fixed an out of bounds memory accesses on too short request which could lead to denial of service bsc1174908. No...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:3383-1)

This update for MozillaFirefox fixes the following issues : Firefox Extended Support Release 78.5.0 ESR bsc1178824 - CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code - CVE-2020-16012: Variable time processing of cross-origin images during...

SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:3413-1)

This update for xen fixes the following issues : Security issue fixed : CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 bsc1178591. Non-security issues fixed : Updated to Xen 4.12.4 bug fix release bsc1027519. Fixed a panic during MSI cleanup on AMD...

SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2020:3092-1)

This update for samba fixes the following issues : CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records bsc1177613. CVE-2020-14323: Unprivileged user can crash winbind bsc1173994. CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify bsc1173902...

SUSE SLES12 Security Update : kernel (SUSE-SU-2020:3281-1)

The SUSE Linux Enterprise 12 SP5 kernel Azure was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-25656: Fixed a concurrency use-after-free in vtdokdgkbioctl bnc1177766. CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in...

SUSE SLES15 Security Update : postgresql10 (SUSE-SU-2020:3455-1)

This update for postgresql10 fixes the following issues : Upgrade to version 10.15 : - CVE-2020-25695, bsc1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. - CVE-2020-25694, bsc1178667: a Fix usage of complex...

SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:3049-1)

This update for xen fixes the following issues : bsc1177409 - VUL-0: CVE-2020-27673: xen: x86 PV guest INVLPG-like flushes may leave stale TLB entries XSA-286 bsc1177412 - VUL-0: CVE-2020-27672: xen: Race condition in Xen mapping code XSA-345 bsc1177413 - VUL-0: CVE-2020-27671: xen: undue deferra...

SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2623-1)

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-1749: Use ip6dstlookupflow instead of ip6dstlookup bsc1165629. CVE-2020-14314: Fixed a potential negative array index in dosplit bsc1173798...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : curl vulnerabilities (USN-4665-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4665-1 advisory. Marc Aldorasi discovered that curl incorrectly handled the libcurl CURLOPTCONNECTONLY option. This could result in data being sen...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:3273-1)

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bug fixes. The following security bugs were fixed : CVE-2020-25656: Fixed a concurrency use-after-free in vtdokdgkbioctl bnc1177766. CVE-2020-8694: Restricted energy meter to root access bsc1170415. The update...

SUSE SLED15 / SLES15 Security Update : postgresql12 (SUSE-SU-2020:3425-1)

This update for postgresql12 fixes the following issues : Upgrade to version 12.5 : - CVE-2020-25695, bsc1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. - CVE-2020-25694, bsc1178667: a Fix usage of complex...

SUSE SLED15 / SLES15 Security Update : perl-DBI (SUSE-SU-2020:3385-1)

This update for perl-DBI fixes the following issues : DBD::File drivers could open files from folders other than those specifically passed via the fdir attribute in the data source name DSN. bsc1176492, CVE-2014-10401, CVE-2014-10402 Note that Tenable Network Security has extracted the preceding...

SUSE SLES15 Security Update : libX11 (SUSE-SU-2020:2474-2)

This update for libX11 fixes the following issues : CVE-2020-14363: Fix an integer overflow in initom bsc1175239. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it a...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : python-apt vulnerability (USN-4668-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4668-1 advisory. Kevin Backhouse discovered that python-apt incorrectly handled resources. A local attacker could possibly use this issue to cause python-a...

SUSE SLES12 Security Update : kernel (SUSE-SU-2020:3648-1)

This update for the Linux Kernel 4.4.121-92146 fixes several issues. The following security issues were fixed : CVE-2020-25668: Fixed a concurrency use-after-free in confontop bsc1178622. CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is...

SUSE SLES12 Security Update : xen (SUSE-SU-2020:3050-1)

This update for xen fixes the following issues : bsc1177409 - VUL-0: CVE-2020-27673: xen: x86 PV guest INVLPG-like flushes may leave stale TLB entries XSA-286 bsc1177412 - VUL-0: CVE-2020-27672: xen: Race condition in Xen mapping code XSA-345 bsc1177413 - VUL-0: CVE-2020-27671: xen: undue deferra...