USN-4400-1: nfs-utils vulnerability

It was discovered that the nfs-utils package set incorrect permissions on the /var/lib/nfs directory. An attacker could possibly use this issue to escalate privileges...

apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default

A flaw was found in the Apache Commons BeanUtils, where the class property in PropertyUtilsBean is not suppressed by default. This flaw allows an attacker to access the classloader...

bind security, bug fix, and enhancement update

32:9.11.13-3 - Fix rwlock to be thread-safe 1740511 32:9.11.13-2 - Release GeoIP data on reload 1790879 32:9.11.13-1 - Update to 9.11.13 32:9.11.12-5 - Report failures on systemctl reload 1739428 32:9.11.12-4 - dhcp: Use monotonic time for detecting time jumps if available 1729211 32:9.11.12-3 -...

Code Injection in easy-team/node-tool-utils

Description The node-tool-utils module is vulnerable against RCE since a command is crafted using user inputs not validated and then executedading to arbitrary command injection POC 1. Create the following PoC file: js // poc.js const tool = require'node-tool-utils'; tool.checkPortUsed"test; touc...

RHEL 8 : targetcli (RHSA-2020:1933)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1933 advisory. The targetcli package contains an administration shell for configuring Internet Small Computer System Interface iSCSI, Fibre Channel over Ethernet...

cifs-utils bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

cifs-utils bug fix and enhancement update

An update is available for cifs-utils. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

fcoe-utils bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

scl-utils bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

aerich (>=0.5.0 <=0.5.1), aiowebthing (>=0.1.16 <=0.1.25) +5 more potentially affected by CVE-2020-11010 via tortoise-orm (>=0.16.13 <=0.16.21)

tortoise-orm PYPI version =0.16.13, =0.5.0, =0.1.16, =0.0.1, =0.1.0, =0.1.2 Source cves: CVE-2020-11010 Source advisory: OSV:PYSEC-2020-144...

aerich (>=0.5.0 <=0.5.1), aiowebthing (>=0.1.16 <=0.1.25) +5 more potentially affected by CVE-2020-11010 via tortoise-orm (>=0.16.13 <=0.16.21)

tortoise-orm PYPI version =0.16.13, =0.5.0, =0.1.16, =0.0.1, =0.1.0, =0.1.2 Source cves: CVE-2020-11010 Source advisory: OSV:GHSA-9J2C-X8QM-QMJQ...

EulerOS Virtualization 3.0.2.2 : cifs-utils (EulerOS-SA-2020-1495)

According to the version of the cifs-utils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Stack-based buffer overflow in cifskey.c or cifscreds.c in cifs-utils before 6.4, as used in pamcifscreds, allows remote attacker...

Huawei EulerOS: Security Advisory for cifs-utils (EulerOS-SA-2020-1495)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Privilege Escalation

nfs-utils is vulnerable to privilege escalation. A flaw was found in the way nfs-utils performed IP based authentication of mount requests. In configurations where a directory was exported to a group of systems using a DNS wildcard or NIS Network Information Service netgroup, an attacker could...

Denial Of Service (DoS)

nfs-utils is vulnerable to denial of service. It was found that the mount.nfs tool did not handle certain errors correctly when updating the mtab mounted file systems table file. A local attacker could use this flaw to corrupt the mtab file...

Race Condition

kernel is vulnerable to race condition. The vulnerability exists as a flaw was found in the Linux kernel's eCryptfs implementation. A local attacker could use the mount.ecryptfsprivate utility to mount and then access a irectory they would otherwise not have access to. Note: To correct this issue...

Denial Of Service (DoS)

encryptfs-utils is vulnerable to denial of service. It was found that mount.ecryptfsprivate did not handle certain errors correctly when updating the mtab mounted file systems table file, allowing a local attacker to corrupt the mtab file and possibly unmount an arbitrary file system...

Access Control Bypass

encryptfs-utils is vulnerable to access control bypass. An insecure temporary file use flaw was found in the ecryptfs-setup-private script. A local attacker could use this script to insert their own key that will subsequently be used by a new user, possibly giving the attacker access to the user'...

Privilege Escalation

encryptfs-utils is vulnerable to privilege escalation. A race condition flaw was found in the way mount.ecryptfsprivate checked the permissions of a requested mount point when mounting an encrypted file system. A local attacker could possibly use this flaw to escalate their privileges by mounting...

Denial Of Service (DoS)

scsi-target-utils is vulnerable to denial of service DoS. The vulnerability exists as a double-free flaw was found in scsi-target-utils' tgtd daemon. A remote attacker could trigger this flaw by sending carefully-crafted network traffic, causing the tgtd daemon to crash...