SUSE-SU-2020:2599-1 Security update for slurm_18_08

This update for slurm1808 fixes the following issues: - Fix Authentication Bypass when Message Aggregation is enabled CVE-2020-12693 This fixes and issue where authentication could be bypassed via an alternate path or channel when message Aggregation was enabled. A race condition allowed a user t...

PT-2020-8620 · Ingenico · Ingenico Telium 2 Pos

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS Telium2 OS versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue allows bypass of file-reading restrictions via the NTPT3 protocol. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N,...

GHSA-7F59-X49P-V8MQ Cross-Site Scripting in swagger-ui

Affected versions of swagger-ui are vulnerable to cross-site scripting in both the consumes and produces parameters of the swagger JSON document for a given API. Additionally, swagger-ui allows users to load arbitrary swagger JSON documents via the query string parameter url, allowing an attacker...

PT-2020-13797 · Apache · Apache Cassandra

Name of the Vulnerable Software and Affected Versions: Apache Cassandra versions prior to 2.1.22 Apache Cassandra versions prior to 2.2.18 Apache Cassandra versions prior to 3.0.22 Apache Cassandra versions prior to 3.11.8 Apache Cassandra versions prior to 4.0-beta2 Description: The issue allows...

GHSA-6898-WX94-8JQ8 Potential Command Injection in libnotify

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify. Untrusted input passed in the call to libnotify.notify could result in execution of shell...

Vulnerability in Platform Mechanism AutoIP

SICK received a report from IOActive that informed SICK about a security vulnerability within the platform mechanism AutoIP, used by multiple devices. SICK recommends updating to the newest version. Refer to the recommended remediations for affected products where no update is available. Currentl...

Updated kernel and kernel-linus packages fix security vulnerabilities

This update is based on the upstream 5.7.19 kernel and fixes at least the following security issue: In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in trymergefreespace ...

Multiple cross-site scripting vulnerabilities in Exment

Overview Exment provided by Kajitori Co.,Ltd contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in some input fields CWE-79 - CVE-2020-5619 Stored cross-site scripting vulnerability in upload files CWE-79 - CVE-2020-5620 Ryoya Koyama of...

MGASA-2020-0338 Updated freerdp packages fix security vulnerability

Integer overflow due to missing input sanitation in rdpegfx channel. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on invalid length arguments to a memcpy CVE-2020-1510...

MGASA-2020-0317 Updated webkit2 packages fix security vulnerability

Updated webkit2 packages fix security vulnerabilities: The webkit2 package has been updated to version 2.28.3, fixing several security issues and other bugs...

PT-2020-5548 · Artifex +7 · Ghostscript +7

Name of the Vulnerable Software and Affected Versions: Artifex Software GhostScript versions 9.50 Description: A buffer overflow issue in the mj raster cmd function allows a remote attacker to cause a denial of service via a crafted PDF file. Recommendations: For Artifex Software GhostScript...

Critical: Red Hat Security Advisory: chromium-browser security update

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

PT-2020-5809

Name of the Vulnerable Software and Affected Versions: Brotli library versions prior to 1.0.8 Description: A buffer overflow exists in the Brotli library where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copyin...

Low: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.31 packages update

Red Hat OpenShift Container Platform release 4.3.31 is now available with updates to packages and images that fix several bugs. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This...

PT-2020-3621 · Gnu +7 · Grub2 +7

Name of the Vulnerable Software and Affected Versions: Grub2 versions prior to 2.06 Description: The issue is related to an integer overflow of the UINT32 value, which can allow an attacker to access confidential data, compromise its integrity, and cause a denial of service. Specifically, the...

OPENSUSE-SU-2020:1074-1 Security update for salt

This update for salt contains the following fixes: - Fix for TypeError in Tornado importer bsc1174165 - Require python3-distro only for TW bsc1173072 - Update to Salt version 3000: See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html - Add docker.logout to docker...

OPENSUSE-SU-2020:0952-1 Security update for nasm

This update for nasm fixes the following issues: nasm was updated to version 2.14.02. This allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes and improvements. Fix crash due to multiple errors or warnings during the code generation pass if a list file is...

OPENSUSE-SU-2020:0950-1 Security update for opera

This update for opera fixes the following issues: - Update to version 69.0.3686.49 - CHR-7971 Update chromium on desktop-stable-83-3686 to 83.0.4103.116 CVE-2020-6509 - DNA-79195 Wrong date on history - DNA-86090 Crash at views::View::ReorderChildViewviews::View, int - DNA-86122 Mac Some popovers...

MGASA-2020-0276 Updated mailman packages fix security vulnerability

Updated mailman package fixes security vulnerability: Up to mailman 2.1.29 when sending a file without a file extension or an unknown file extension then the file is stored in the list archive with the file extension .obj. Most web servers will try to assign a mime type based on the file extensio...

PT-2020-6205 · Ilm +4 · Openexr +4

Name of the Vulnerable Software and Affected Versions: OpenEXR versions prior to 2.5.2 Description: The issue is related to a heap buffer overflow in the getChunkOffsetTableSize function in IlmImf/ImfMisc.cpp. This overflow can occur due to invalid chunkCount attributes. The exploitation of this...