Fedora 31 : chromium (2020-7fd051b378)

Update to 80.0.3987.149. Upstream says it fixes '13' security issues, but only lists these CVEs : - CVE-2020-6422: Use after free in WebGL - CVE-2020-6424: Use after free in media - CVE-2020-6425: Insufficient policy enforcement in extensions. - CVE-2020-6426: Inappropriate implementation in V8 -...

Fedora 31 : timeshift (2020-6b3ae09449)

Security fix for CVE-2020-10174 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Debian DLA-2152-1 : graphicsmagick security update

A vulnerability was discovered in graphicsmagick, a collection of image processing tools, that allows allows an attacker to read arbitrary files via a crafted image because of TranslateTextEx for SVG. For Debian 8 'Jessie', this problem has been fixed in version 1.3.20-3+deb8u9. We recommend that...

RHEL 6 : python-imaging (RHSA-2020:0898)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0898 advisory. The Python Imaging Library PIL adds image processing capabilities to your Python interpreter. This library provides extensive file format support, an...

Debian DLA-2151-1 : icu security update

It was discovered that an integer overflow in the International Components for Unicode ICU library could result in denial of service and potentially the execution of arbitrary code. For Debian 8 'Jessie', this problem has been fixed in version 52.1-8+deb8u8. We recommend that you upgrade your icu...

Debian DLA-2149-1 : rails security update

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j or escapejavascript methods may be susceptible to XSS attacks. For Debian 8 'Jessie', this problem has been fixed in version...

Trend Micro Fixes Critical Flaws Under Attack

Trend Micro has released security updates patching five vulnerabilities in its endpoint security solutions, Apex One and OfficeScan XG for Windows. Specifically, Apex One 2019 and OfficeScan XG SP1 and XG are affected by four critical-severity and one high-severity flaws. Two of these...

Trend Micro Fixes Critical Flaws Under Attack

Trend Micro has released security updates patching five vulnerabilities in its endpoint security solutions, Apex One and OfficeScan XG for Windows. Specifically, Apex One 2019 and OfficeScan XG SP1 and XG are affected by four critical-severity and one high-severity flaws. Two of these...

Ubuntu 16.04 LTS : Linux kernel vulnerability (USN-4303-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4303-1 advisory. Paulo Bonzini discovered that the KVM hypervisor implementation in the Linux kernel could improperly let a nested level 2 guest access the resources of a parent...

Fedora 30 : php-horde-Horde-Form (2020-a69f99bc67)

HordeForm 2.0.20 - mjr SECURITY: Prevent ability to specify temporary filename CVE-2020-8866, Reported By: Andrea Cardaci working with Trend Micro Zero Day Initiative. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

Fedora 31 : php-horde-Horde-Form (2020-a55b70b4ab)

HordeForm 2.0.20 - mjr SECURITY: Prevent ability to specify temporary filename CVE-2020-8866, Reported By: Andrea Cardaci working with Trend Micro Zero Day Initiative. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

RHEL 8 : firefox (RHSA-2020:0820)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0820 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

Debian DLA-2144-1 : qemu security update

Two out-of-bounds heap buffer accesses were found in QEMU, a fast processor emulator, which could result in denial of service or abitrary code execution. For Debian 8 'Jessie', these problems have been fixed in version 1:2.1+dfsg-12+deb8u14. We recommend that you upgrade your qemu packages. NOTE:...

RHEL 7 : python-virtualenv (RHSA-2020:0851)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0851 advisory. The virtualenv tool creates isolated Python environments. The virtualenv tool is a successor to workingenv, and an extension of...

Debian DLA-2146-1 : libvncserver security update

In libvncserver, through libvncclient/cursor.c, there is a possibility of a heap overflow, as reported by Pavel Cheremushkin. For Debian 8 'Jessie', this problem has been fixed in version 0.9.9+dfsg2-6.1+deb8u7. We recommend that you upgrade your libvncserver packages. NOTE: Tenable Network...

Fedora 31 : weechat (2020-db890b4800)

New version, fixes a lot of bugs some of them security. In the same update, fixed up epel7 build to latest version as well. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean...

SUSE SLED15 / SLES15 Security Update : wireshark (SUSE-SU-2020:0693-1)

This update for wireshark and libmaxminddb fixes the following issues : Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support bsc1156288. New features include : Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC Improve...

Debian DLA-2142-1 : slirp security update

It was discovered that there was a buffer overflow vulnerability in slirp, a SLIP/PPP emulator for using a dial up shell account. This was caused by the incorrect usage of return values from snprintf3. For Debian 8 'Jessie', this issue has been fixed in slirp version 1:1.0.17-7+deb8u2. We recomme...

EulerOS Virtualization for ARM 64 3.0.2.0 : samba (EulerOS-SA-2020-1231)

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP...

EulerOS Virtualization for ARM 64 3.0.2.0 : rsync (EulerOS-SA-2020-1257)

According to the versions of the rsync package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The recvfiles function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds wit...