Microsoft Project Information Disclosure Vulnerability

An information disclosure vulnerability exists when Microsoft Project reads out of bound memory due to an uninitialized variable. An attacker who successfully exploited the vulnerability could view out of bound memory that potentially could contain sensitive information. Exploitation of the...

Description of the security update for Project 2016: June 9, 2020

None None...

Apple macOS Catalina ksh shell command execution vulnerability

Apple macOS Catalina is a specialized operating system developed for Mac computers. A security vulnerability in the Apple macOS Catalina ksh handling environment variable allows local attackers to exploit the vulnerability to submit a special request that can execute arbitrary SHELL commands...

Double free when calling `sys_info::disk_info` from multiple threads

Affected versions of sys-info use a static, global, list to store temporary disk information while running. The function that cleans up this list, DFCleanup, assumes a single threaded environment and will try to free the same memory twice in a multithreaded environment. This results in consistent...

Updated clamav packages fix security vulnerabilities

Updated clamav packages fix security vulnerabilities: Fixed a vulnerability in the ARJ archive-parsing module in ClamAV 0.102.2 that could cause a denial-of-service condition. Improper bounds checking of an unsigned variable results in an out-of-bounds read which causes a crash. Special thanks to...

clamav -- multiple vulnerabilities

Micah Snyder reports: CVE-2020-3327: Fixed a vulnerability in the ARJ archive-parsing module in ClamAV 0.102.2 that could cause a denial-of-service condition. Improper bounds checking of an unsigned variable results in an out-of-bounds read which causes a crash. Special thanks to Daehui Chang and...

Google chrome-launcher OS command injection vulnerability

Google chrome-launcher is a launcher for launching the Chrome browser from Node.js by Google USA. An operating system command injection vulnerability exists in Google chrome-launcher all versions, which can be exploited to execute arbitrary commands by controlling the $ HOME environment variable ...

wavpack security update

5.1.0-15 - fix Out-of-bounds read in WavpackVerifySingleBlock function 1663151 - CVE-2018-19841 5.1.0-14 - fix uninitialized variable in ParseCaffHeaderConfig 1741251 - CVE-2019-1010317 5.1.0-13 - fortify parsing of .dff files 1707428, 1733627 - CVE-2019-1010315 - CVE-2019-11498 5.1.0-12 - fix...

CVE-2020-7645

All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems...

CVE-2020-7645

All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems...

CVE-2020-7645

All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems...

CVE-2020-7645

All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems...

CVE-2020-11674

Cerner medico 26.00 allows variable reuse, possibly causing data corruption...

CVE-2020-11674

Cerner medico 26.00 allows variable reuse, possibly causing data corruption...

Memory corruption

Cerner medico 26.00 allows variable reuse, possibly causing data corruption...

CVE-2020-11674

CVE-2020-11674 affects Cerner medico 26.00. Affected component: the system’s handling of variables, where variable reuse can lead to data corruption. Primary sources (NVD, Red Hat, CNVD, CVE listing) confirm data integrity impact with CVSS v3.1 base score 8.8 (HIGH) and adjacent access, low attac...

Denial Of Service (DoS)

wavpack is vulnerable to denial of service DoS. The vulnerability exists through the use of uninitialized variable in WavpackSetConfiguration64 leads to DoS...

Linux: Strictly define variable user PATH variable

The requirement aims to prevent system commands from being replaced by malicious commands, ensuring that system commands can be executed securely. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

Linux: Strictly define variable LD_LIBRARY_PATH

Check whether variable LDLIBRARYPATH or any equivalent variable exists in the user environmentroot or other environments. If yes, the variable should refer to the /lib, /usr/lib, /var/lib, /usr/X11R6/lib library only. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be...

glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries

A vulnerability was discovered in glibc where the LDPREFERMAP32BITEXEC environment variable is not ignored when running binaries with the setuid flag on x8664 architectures. This allows an attacker to force system to utilize only half of the memory making the system think the software is 32-bit...