MGASA-2020-0376 Updated cifs-utils packages fix security vulnerability

The mount.cifs utility has a shell injection issue where one can embed shell commands via the username mount option. Those commands will be run via popen in the context of the user calling mount CVE-2020-14342...

SUSE-SU-2020:2729-1 Security update for cifs-utils

This update for cifs-utils fixes the following issues: - CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs bsc1174477. - Fixed an invalid free in mount.cifs; bsc1152930...

SUSE-SU-2020:2728-1 Security update for cifs-utils

This update for cifs-utils fixes the following issues: - CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs bsc1174477...

Privilege Escalation

cifs-utils:devel is vulnerable to privilege escalation. It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could...

Important Photon OS Security Update - PHSA-2020-3.0-0142

Updates of 'linux-aws', 'libxml2', 'linux', 'kubernetes', 'linux-secure', 'linux-esx', 'linux-rt', 'cifs-utils', 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2020-0142

Updates of 'libxml2', 'cifs-utils', 'kubernetes', 'go', 'linux-rt', 'linux-esx', 'linux', 'linux-secure', 'linux-aws' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2020-0325

Updates of 'cifs-utils', 'go', 'kubernetes', 'libxml2' packages of Photon OS have been released...

AZL-6353 CVE-2020-14342 affecting package cifs-utils for versions less than 6.8-6

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges...

CVE-2020-14342

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges...

CVE-2020-14342

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges...

Design/Logic Flaw

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges...

CVE-2020-14342

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges...

CVE-2020-14342

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges...

CVE-2020-14342

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges...

CVE-2020-14342

CVE-2020-14342 affects cifs-utils’ mount.cifs, which can invoke a shell when requesting the Samba password. This enables local attackers with sufficient permissions (for example via sudo rule configurations) to inject commands and escalate privileges. Public advisories confirm a shell-injection f...

CVE-2020-14342

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges...

CVE-2020-14342

A flaw was found in cifs-utils' mount.cifs where it was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. This flaw allows an attacker who can invoke mount.cifs with special permission, such as via sudo rules, to escalate their privileges. The...

matlab-array-utils (>=1.0.1 <=1.0.2), react-plotter (=0.0.1) potentially affected by unknown CVE via plotter (=0.5.0)

plotter NPM version =0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on plotter and may be impacted: - matlab-array-utils =1.0.1, =1.0.2 - react-plotter =0.0.1 Source cves: unknown CVE Source advisory: OSV:GHSA-65XX-C85X-WG76...

GHSA-6PQ3-928Q-X6W6 Prototype Pollution

All versions of utils-extend are vulnerable to prototype pollution. The extend function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available...

1filecompiler (=0.0.2), @adrian.u/adritoolbox (>=1.0.0 <=1.1.0) +801 more potentially affected by CVE-2020-8147 via utils-extend (=1.0.8)

utils-extend NPM version =1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on utils-extend and may be impacted: - 1filecompiler =0.0.2 - @adrian.u/adritoolbox =1.0.0, =0.1.1, =0.1.0, =0.1.0, =1.0.2, =0.1.0, =0.0.1, =0.37.8, =1.0.1, =0.1.0, =1.0.2,...