chromium -- multiple vulnerabilities

Chrome Releases reports: This release contains 8 security fixes, including: 1142331 High CVE-2020-16037: Use after free in clipboard. Reported by Ryoya Tsukasaki on 2020-10-26 1138683 High CVE-2020-16038: Use after free in media. Reported by Khalil Zhani on 2020-10-14 1149177 High CVE-2020-16039:...

asterisk -- Remote crash in res_pjsip_diversion

The Asterisk project reports: AST-2020-003: A crash can occur in Asterisk when a SIP message is received that has a History-Info header, which contains a tel-uri. AST-2020-004: A crash can occur in Asterisk when a SIP 181 response is received that has a Diversion header, which contains a tel-uri...

Unbound/NSD -- Denial of service vulnerability

NLNetLabs reports: Unbound and NSD when writing the PID file would not check if an existing file was a symlink. This could allow for a local symlink \ attack if an attacker has access to the user Unbound/NSD runs as...

FreeBSD -- ICMPv6 use-after-free in error message handling

Problem Description: When an ICMPv6 error message is received, the FreeBSD ICMPv6 stack may extract information from the message to hand to upper-layer protocols. As a part of this operation, it may parse IPv6 header options from a packet embedded in the ICMPv6 message. The handler for a routing...

FreeBSD -- Multiple vulnerabilities in rtsold

Problem Description: Two bugs exist in rtsold8's RDNSS and DNSSL option handling. First, rtsold8 failed to perform sufficient bounds checking on the extent of the option. In particular, it does not verify that the option does not extend past the end of the received packet before processing its...

xorg-server -- Multiple input validation failures in X server XKB extension

The X.org project reports: These issues can lead to privileges elevations for authorized clients on systems where the X server is running privileged. Insufficient checks on the lengths of the XkbSetMap request can lead to out of bounds memory accesses in the X server. Insufficient checks on input...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.13.0: Add Allow-/Block-List for Migrate and Mirrors Prevent git operations for inactive users Disallow urlencoded new lines in git protocol paths if there is a port Mitigate Security vulnerability in the git hook feature Disable DSA ssh keys by default Set TLS...

binutils -- excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c read_section()

Hao Wang reports: There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of excessive memory consumption...

raptor2 -- malformed input file can lead to a segfault

Redland Issue Tracker reports: due to an out of bounds array access in raptorxmlwriterstartelementcommon...

sympa -- Unauthorised full access via SOAP API due to illegal cookie

Sympa community reports: Unauthorised full access via SOAP API due to illegal cookie...

mutt -- authentication credentials being sent over an unencrypted connection

Kevin J. McCarthy reports: Mutt had incorrect error handling when initially connecting to an IMAP server, which could result in an attempt to authenticate without enabling TLS...

x11vnc -- access to shared memory segments

[email protected] reports: scan.c in x11vnc 0.9.16 uses IPCCREAT|0777 in shmget calls, which allows access by actors other than the current user...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.12.6: Prevent git operations for inactive users Disallow urlencoded new lines in git protocol paths if there is a port...

Node.js -- November 2020 Security Releases

Node.js reports: Updates are now available for v12.x, v14.x and v15.x Node.js release lines for the following issues. Denial of Service through DNS request CVE-2020-8277 A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of...

mantis -- multiple vulnerabilities

Mantis 2.24.4 release reports: Security and maintenance release, addressing 6 CVEs: 0027726: CVE-2020-29603: disclosure of private project name 0027727: CVE-2020-29605: disclosure of private issue summary 0027728: CVE-2020-29604: full disclosure of private issue contents, including bugnotes and...

go -- math/big: panic during recursive division of very large numbers; cmd/go: arbitrary code execution at build time through cgo

The Go project reports: A number of math/big.Int methods Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD can panic when provided crafted large inputs. For the panic to happen, the divisor or modulo argument must be larger than 3168 bits on 32-bit architectures or 633...

moinmoin -- multiple vulnerabilities

MoinMoin reports: Security fix for CVE-2020-25074: fix remote code execution via cache action Security fix for CVE-2020-15275: fix malicious SVG attachment causing stored XSS vulnerability...

salt -- multiple vulnerabilities

SaltStack reports multiple security vulnerabilities in Salt 3002: CVE-2020-16846: Prevent shell injections in netapi ssh client. CVE-2020-17490: Prevent creating world readable private keys with the tls execution module. CVE-2020-25592: Properly validate eauth credentials and tokens along with...

asterisk -- Remote crash in res_pjsip_session

The Asterisk project reports: Upon receiving a new SIP Invite, Asterisk did not return the created dialog locked or referenced. This caused a gap between the creation of the dialog object, and its next use by the thread that created it. Depending upon some off nominal circumstances, and timing it...

asterisk -- Outbound INVITE loop on challenge with different nonce

The Asterisk project reports: If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate even if the call is hung up,...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release contains 10 security fixes, including: 1138911 High CVE-2020-16004: Use after free in user interface. Reported by Leecraso and Guang Gong of 360 Alpha Lab working with 360 BugCloud on 2020-10-15 1139398 High CVE-2020-16005: Insufficient policy enforcement in...

consul -- Fix Consul Connect CA private key configuration

Hashicorp reports: Increase the permissions to read from the /connect/ca/configuration endpoint to operator:write. Previously Connect CA configuration, including the private key, set via this endpoint could be read back by an operator with operator:read privileges...

Gitlab -- Multiple vulnerabilities

Gitlab reports: Path Traversal in LFS Upload Path traversal allows saving packages in arbitrary location Kubernetes agent API leaks private repos Terraform state deletion API exposes object storage URL Stored-XSS in error message of build-dependencies Git credentials persisted on disk Potential...

bouncycastle15 -- bcrypt password checking vulnerability

The Bouncy Castle team reports: The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different...

darkhttpd -- DOS vulnerability

Mitre reports: flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause denial-of-service by accessing a file with a large modification date. The highest threat from this vulnerability is to system availability...

wordpress -- multiple issues

wordpress developers reports: Ten security issues affect WordPress versions 5.5.1 and earlier. If you havent yet updated to 5.5, all WordPress versions since 3.7 have also been updated to fix the following security issues: -Props to Alex Concha of the WordPress Security Team for their work in...

samba -- Multiple Vulnerabilities

The Samba Team reports: CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify CVE-2020-14323: Unprivileged user can crash winbind CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records...

tmux -- stack overflow in CSI parsing

Nicholas Marriott reports: tmux has a stack overflow in CSI parsing...

ImageMagick7 -- multiple vulnerabilities

CVE reports: Several vulnerabilities have been discovered in ImageMagick: CVE-2021-20313: A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. CVE-2021-20312: A flaw was found in ImageMagick in versions...

glpi -- Insecure Direct Object Reference on ajax/getDropdownValue.php

MITRE Corporation reports: In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference IDOR vulnerability that allows an attacker to read data from any itemType e.g., Ticket, Users, etc...

glpi -- Insecure Direct Object Reference on ajax/comments.ph

MITRE Corporation reports: In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference IDOR vulnerability that allows an attacker to read data from any database table e.g., glpitickets, glpiusers, etc...

nomad -- multiple vulnerabilities

The HashiCorp team reports: artifact: Fixed a bug where interpolation can be used in the artifact destination field to write artifact payloads outside the allocation directory. template: Fixed a bug where interpolation can be used in the template source and destination fields to read or write fil...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release includes 5 security fixes: 1125337 High CVE-2020-16000: Inappropriate implementation in Blink. Reported by amaebijp on 2020-09-06 1135018 High CVE-2020-16001: Use after free in media. Reported by Khalil Zhani on 2020-10-05 1137630 High CVE-2020-16002: Use aft...

MySQL -- Multiple vulnerabilities

Oracle reports: This Critical Patch Update contains 48 new security patches for Oracle MySQL. The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle MySQL is 8. NOTE: MariaDB only contains CVE-2020-14812 CVE-2020-14765 CVE-2020-14776 and CVE-2020-14789...

freetype2 -- heap buffer overlfow

The freetype project reports: A heap buffer overflow has been found in the handling of embedded PNG bitmaps, introduced in FreeType version 2.6...

jupyter notebook -- open redirect vulnerability

Jupyter reports: 6.1.5 is a security release, fixing one vulnerability: Fix open redirect vulnerability GHSA-c7vm-f5p4-8fqh CVE to be assigned...

Flash Player -- arbitrary code execution

Adobe reports: This update resolves a NULL pointer dereference vulnerability that could lead to arbitrary code execution CVE-2020-9746...

powerdns-recursor -- cache pollution

PowerDNS Team reports: CVE-2020-25829: An issue has been found in PowerDNS Recursor where a remote attacker can cause the cached records for a given name to be updated to the ‘Bogus’ DNSSEC validation state, instead of their actual DNSSEC ‘Secure’ state, via a DNS ANY query. This results in a...

MariaDB -- Undisclosed vulnerability

The MariaDB project reports: Details of this vulnerability have not yet been disclosed...

Rails -- Possible XSS vulnerability

Ruby on Rails blog: Rails version 6.0.3.4 has been released! This version is a security release and addresses one possible XSS attack vector in Actionable Exceptions...

chromium -- multiple vulnerabilities

Chrome releases reports: This release contains 35 security fixes, including: 1127322 Critical CVE-2020-15967: Use after free in payments. Reported by Man Yue Mo of GitHub Security Lab on 2020-09-11 1126424 High CVE-2020-15968: Use after free in Blink. Reported by Anonymous on 2020-09-09 1124659...

motion -- Denial of Service

cxsecurity.com reports: A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request...

py-ansible -- multiple vulnerabilities

abeluck reports: A flaw was found in Ansible Base when using the awsssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confidentiality. A flaw was found in Ansible Base...

python 3.9 -- end of life, not receiving security support

Unsupported versions: ... End of life: 2025-10-31...

kdeconnect -- packet manipulation can be exploited in a Denial of Service attack

Albert Astals Cid reports: KDE Project Security Advisory Title KDE Connect: packet manipulation can be exploited in a Denial of Service attack Risk Rating Important CVE CVE-2020-26164 Versions kdeconnect Date 2 October 2020 Overview An attacker on your local network could send maliciously crafted...

glpi -- Any CalDAV calendars is read-only for every authenticated user

MITRE Corporation reports: In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of every other user, even admin ones. This issue is fixed in version 9.5.3. As a workaround, one can remove the caldav.php file to block access to CalDAV server...

py-matrix-synapse -- XSS vulnerability

Matrix developers reports: The fallback authentication endpoint served via Synapse were vulnerable to cross-site scripting XSS attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities,...

Gitlab -- multiple vulnerabilities

Gitlab reports: Potential Denial Of Service Via Update Release Links API Insecure Storage of Session Key In Redis Improper Access Expiration Date Validation Cross-Site Scripting in Multiple Pages Unauthorized Users Can View Custom Project Template Cross-Site Scripting in SVG Image Preview...

zeek -- Vulnerability due to memory leak

Jon Siwek of Corelight reports: This release fixes the following security issue: A memory leak in multipart MIME code has potential for remote exploitation and cause for Denial of Service via resource exhaustion...

dovecot-pigeonhole -- Sieve excessive resource usage

Dovecot team reports reports: Sieve interpreter is not protected against abusive scripts that claim excessive resource usage. Fixed by limiting the user CPU time per single script execution and cumulatively over several script runs within a configurable timeout period. Sufficiently large CPU time...