SUSE SLED15 / SLES15 Security Update : util-linux / shadow (SUSE-SU-2019:2307-1)

This update for util-linux and shadow fixes the following issues : util-linux : Fixed an issue where PATH settings in /etc/default/su being ignored bsc1121197 Prevent outdated pam files bsc1082293. De-duplicate fstrim -A properly bsc1127701. Do not trim read-only volumes bsc1106214. Integrate...

SUSE-SU-2019:2307-1 Security update for util-linux and shadow

This update for util-linux and shadow fixes the following issues: util-linux: - Fixed an issue where PATH settings in /etc/default/su being ignored bsc1121197 - Prevent outdated pam files bsc1082293. - De-duplicate fstrim -A properly bsc1127701. - Do not trim read-only volumes bsc1106214. -...

Scientific Linux Security Update : nss, nss-softokn, nss-util, and nspr on SL7.x x86_64 (20190806)

Netscape Portable Runtime NSPR provides platform independence for non- GUI operating system facilities. The following packages have been upgraded to a later upstream version: nss 3.44.0, nss-softokn 3.44.0, nss-util 3.44.0, nspr 4.21.0. Security Fixes : - ROHNP: Key Extraction Side Channel in...

Buffer overflow vulnerability in libming 'readBytes' function

libming is a Flash SWF output library written in C. It can be used as a library to export Flash SWF files to other languages. A buffer overflow vulnerability exists in the 'readBytes' function of the util/read.c file in libming 0.4.8 and earlier. No detailed vulnerability details are provided at...

nss, nss-softokn, nss-util, and nspr security, bug fix, and enhancement update

nspr 4.21.0-1 - Rebase to NSPR 4.21 nss 3.44.0-4 - Fix certutil man page - Fix extracting a public key from a private key for dh, ec, and dsa 3.44.0-3 - Disable TLS 1.3 under FIPS mode - Disable RSASSA-PKCS1-v15 in TLS 1.3 - Fix post-handshake auth transcript calculation if SSLENABLESESSIONTICKET...

RHEL 7 : nss, nss-softokn, nss-util, and nspr (RHSA-2019:2237)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2237 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

CVE-2019-12959

Server Side Request Forgery SSRF exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter...

opensc: Buffer overflow handling string concatention in tools/util.c:util_acl_to_str()

A buffer overflow when handling string concatenation in utilacltostr in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service application crash or possibly have unspecified other impact...

EulerOS 2.0 SP2 : util-linux (EulerOS-SA-2019-1737)

According to the version of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.CVE-2014-9114 Note that Tenable Network Security has extracted...

EulerOS Virtualization for ARM 64 3.0.2.0 : util-linux (EulerOS-SA-2019-1694)

According to the version of the util-linux packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.CVE-2014-9114 Note that Tenable...

EulerOS 2.0 SP5 : util-linux (EulerOS-SA-2019-1670)

According to the version of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.CVE-2014-9114 Note that Tenable Network Security has extracted...

CVE-2018-9563

In llcputilparsecc of llcputil.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1...

EulerOS Virtualization 3.0.1.0 : util-linux (EulerOS-SA-2019-1462)

According to the version of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use thi...

Man-in-the-Middle Attack

nss-util is vulnerable to a man-in-the-middle attack. The library accepts a wildcard character that is embedded in an internationalized domain name's U-labels in the certTestHostName function in lib/certdb/certdb.c , allowing a malicious user to spoof SSL servers via a crafted certificate...

Open Redirect

The openshift-origin-node-util package provides a set of utility scripts for a node. Red Hat OpenShift Enterprise is a cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud deployments. A flaw was found in the way the administrative web interface for restori...

Cross-site Scripting (XSS)

jetty-util is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the directory listing does not encode characters in UTF-8, allowing a remote attacker to inject arbitrary Javascript into a victim's browser through unicode characters...

Information Disclosure

jetty-util is vulnerable to information disclosure. Eclipse Jetty on Windows reveals the resource base path of files in the directory listings page...

ALPINE-CVE-2019-11455

A buffer over-read in UtilurlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST parameters. The attacker can also cause a denial of service application outage...

DEBIAN-CVE-2019-11455

A buffer over-read in UtilurlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST parameters. The attacker can also cause a denial of service application outage...

EulerOS Virtualization 2.5.3 : util-linux (EulerOS-SA-2019-1175)

According to the version of the util-linux package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.i1/4^CVE-2014-9114i1/4%0 Note that Tenable Netwo...