Important Photon OS Security Update - PHSA-2020-0086

Updates of 'util-linux', 'git' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2020-0235

Updates of 'docker', 'unixODBC', 'openjdk11', 'util-linux', 'systemd', 'openjdk8', 'lz4' packages of Photon OS have been released...

Huawei EulerOS: Security Advisory for nss-util (EulerOS-SA-2020-1415)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : nss-util (EulerOS-SA-2020-1415)

According to the version of the nss-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory a...

Code Injection in heroku/heroku-exec-util

Description The heroku-exec-util module is vulnerable against RCE since a command is crafted using user inputs not validated and then executed, leading to arbitrary command injection POC 1. Create the following PoC file: js // poc.js var heu = require'heroku-exec-util'; heu.sshargs:,'test; touch...

Privilege Escalation

util-linux is vulnerable to privilege escalation. A local, unprivileged user allowed to mount or unmount file systems could use these flaws to corrupt the mtab file and create a stale lock file, preventing other users from mounting and unmounting file systems...

Privilege Escalation

util-linux is vulnerable to privilege escalation. A local, unprivileged user allowed to mount or unmount file systems could use these flaws to corrupt the mtab file and create a stale lock file, preventing other users from mounting and unmounting file systems...

Denial Of Service (DoS)

apr-util is vulnerable to denial of service. It was found that certain input could cause the apr-util library to allocate more memory than intended in the aprbrigadesplitline function. An attacker able to provide input in small chunks to an application using the apr-util library such as httpd cou...

Log Injection

util-linux is vulnerable to log injection. The vulnerability exists in util-linux when logging log in attempts via the audit subsystem of the Linux kernel. A remote attacker could use this flaw to modify certain parts of logged events, possibly hiding their activities on a system...

Privilege Escalation

util-linux is vulnerable to privilege escalation. The vulnerability exists as a flaw was discovered in the way that the mount and umount utilities used the setuid and setgid functions, which could lead to privileges being dropped improperly. A local user could use this flaw to run mount helper...

httpd security, bug fix, and enhancement update

2.4.6-93.0.1 - replace index.html with Oracles index page oracleindex.html 2.4.6-93 - Resolves: 1677496 - CVE-2018-17199 httpd: modsessioncookie does not respect expiry time 2.4.6-92 - htpasswd: add SHA-2 crypt support 1486889 2.4.6-91 - Resolves: 1630886 - scriptlet can fail if hostname is not...

Huawei EulerOS: Security Advisory for util-linux (EulerOS-SA-2020-1243)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization for ARM 64 3.0.2.0 : util-linux (EulerOS-SA-2020-1243)

According to the version of the util-linux packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of...

CVE-2020-0053

In convertHidlNanDataPathInitiatorRequestToLegacy, and convertHidlNanDataPathIndicationResponseToLegacy of hidlstructutil.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User...

CVE-2019-10806

vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype...

CVE-2019-10806

vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype...

Design/Logic Flaw

vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype...

CVE-2019-10806

vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype...

CVE-2019-10806

The CVE-2019-10806 issue affects vega-util prior to 1.13.1: the vega.mergeConfig method can be exploited to add or modify properties on Object.prototype (prototype pollution). This is caused by improper handling in mergeConfig, enabling an attacker to trigger changes to built-in Object properties...

PT-2020-9156 · Vega-Util · Vega-Util

Name of the Vulnerable Software and Affected Versions: vega-util versions prior to 1.13.1 Description: The issue allows manipulation of the object prototype. The vega.mergeConfig method within vega-util can be tricked into adding or modifying properties of the Object.prototype. Recommendations: F...