Security update for unbound (important)

openSUSE Security Update: Security update for unbound Announcement ID: openSUSE-SU-2020:0912-1 Rating: important References: 1157268 1171889 Cross-References: CVE-2019-18934 CVE-2020-12662 CVE-2020-12663 Affected Products: openSUSE Leap 15.1 An update that fixes three vulnerabilities is now...

Fedora 31 : fwupd (2020-ad1c74c2a1)

New upstream release - Actually reload the DFU device after upgrade has completed - Capture the dock SKU in report metadata - Correctly set the Logitech device protocol - Do not use shim for non-secure boot configurations - Ensure that the DeviceID is set for child devices - Fix an error when...

gdal:lvbag_fuzzer: Heap-buffer-overflow in OGR_RawField_IsUnset

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5186645136769024 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: lvbagfuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6020000038b0 Cras...

CVE-2019-20892

net-snmp before 5.8.1.pre1 has a double free in usmfreeusmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release...

unbound: infinite loop via malformed DNS answers received from upstream servers

A flaw was found in unbound in versions prior to 1.10.1. An infinite loop can be created when malformed DNS answers are received from upstream servers. The highest threat from this vulnerability is to system availability...

[SECURITY] [DLA 2233-2] python-django regression update

Package : python-django Version : 1.7.11-1+deb8u10 CVE ID : CVE-2020-13254 It was discovered that there was a regression in the latest update to Django, the Python web development framework. The upstream fix for CVE-2020-13254 to address data leakages via malformed memcached keys could, in some...

Debian DSA-4701-1 : intel-microcode - security update

This update ships updated CPU microcode for some types of Intel CPUs and provides mitigations for the Special Register Buffer Data Sampling CVE-2020-0543 , Vector Register Sampling CVE-2020-0548 and L1D Eviction Sampling CVE-2020-0549 hardware vulnerabilities. The microcode update for HEDT and Xe...

RHEL 8 : kernel (RHSA-2020:2427)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2427 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: use-after-free in block/bfq-iosched.c...

unbound: infinite loop via malformed DNS answers received from upstream servers

A flaw was found in unbound in versions prior to 1.10.1. An infinite loop can be created when malformed DNS answers are received from upstream servers. The highest threat from this vulnerability is to system availability...

unbound: infinite loop via malformed DNS answers received from upstream servers

A flaw was found in unbound in versions prior to 1.10.1. An infinite loop can be created when malformed DNS answers are received from upstream servers. The highest threat from this vulnerability is to system availability...

unbound: infinite loop via malformed DNS answers received from upstream servers

A flaw was found in unbound in versions prior to 1.10.1. An infinite loop can be created when malformed DNS answers are received from upstream servers. The highest threat from this vulnerability is to system availability...

unbound: infinite loop via malformed DNS answers received from upstream servers

A flaw was found in unbound in versions prior to 1.10.1. An infinite loop can be created when malformed DNS answers are received from upstream servers. The highest threat from this vulnerability is to system availability...

CVE-2020-10703

A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools li...

leptonica:barcode_fuzzer: Heap-use-after-free in pixAverageRasterScans

Project: https://github.com/DanBloomberg/leptonica.git Detailed Report: https://oss-fuzz.com/testcase?key=5643281198481408 Project: leptonica Fuzzing Engine: afl Fuzz Target: barcodefuzzer Job Type: aflasanleptonica Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address:...

gdal:gdal_translate_fuzzer: Heap-buffer-overflow in GDALResampleChunk32R_Mode

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5677488700391424 Project: gdal Fuzzing Engine: afl Fuzz Target: gdaltranslatefuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x603000017490 Crash...

Fedora 31 : clamav (2020-b0acd7b66e)

ClamAV 0.102.3 is a bug patch release to address the following issues. - CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.2 that could cause a Denial-of-Service DoS condition. Improper bounds checking of an unsigned variable results in an out-of-bounds read whi...

Security fix for the ALT Linux 8 package bind version 9.10.8.P1-alt2

9.10.8.P1-alt2 built May 26, 2020 Stanislav Levin in task 251959 May 19, 2020 Stanislav Levin - Applied upstream patches fixes: CVE-2020-8616, CVE-2020-8617...

MGASA-2020-0227 Updated kernel packages fix security vulnerability

This update is based on the upstream 5.6.14 kernel and fixes at least the following security issues: A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option CIPSO protocol's catego...

Updated unbound packages fix security vulnerabilities

Updated unbound packages fix security vulnerabilities: Unbound can be tricked into amplifying an incoming query into a large number of queries directed to a target CVE-2020-12662. Malformed answers from upstream name servers can be used to make Unbound unresponsive CVE-2020-12663...

CVE-2020-12663

A flaw was found in unbound in versions prior to 1.10.1. An infinite loop can be created when malformed DNS answers are received from upstream servers. The highest threat from this vulnerability is to system availability...