OS: Scientific
Mozilla: Information disclosure due to manipulated URL object (CVE-2020-12418) * Mozilla: Use-after-free in nsGlobalWindowInner (CVE-2020-12419) * Mozilla: Use-After-Free when trying to connect to a STUN server (CVE-2020-12420) * Mozilla: Add-On updates did not respect the same certificate trust rules as software updates (CVE-2020-12421) SL6 x86_64 firefox-68.10.0-1.el6_10.x86_64.rpm [More...] |
Mozilla: Memory corruption due to missing sign-extension for ValueTags on ARM64 (CVE-2020-12417) * Mozilla: Information disclosure due to manipulated URL object (CVE-2020-12418) * Mozilla: Use-after-free in nsGlobalWindowInner (CVE-2020-12419) * Mozilla: Use-After-Free when trying to connect to a STUN server (CVE-2020-12420) * Mozilla: Add-On updates did not respect the same certificate tr [More...] |
Kernel: vfio: access to disabled MMIO space of some devices may lead to DoS scenario (CVE-2020-12888) SL7 x86_64 bpftool-3.10.0-1127.13.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1127.13.1.el7.x86_64.rpm kernel-3.10.0-1127.13.1.el7.x86_64.rpm kernel-debug-3.10.0-1127.13.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1127.13.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1 [More...] |
ntp: ntpd using highly predictable transmit timestamps could result in time change or DoS (CVE-2020-13817) * ntp: DoS on client ntpd using server mode packet (CVE-2020-11868) SL7 x86_64 ntp-4.2.6p5-29.el7_8.2.x86_64.rpm ntp-debuginfo-4.2.6p5-29.el7_8.2.x86_64.rpm ntpdate-4.2.6p5-29.el7_8.2.x86_64.rpm sntp-4.2.6p5-29.el7_8.2.x86_64.rpm noarch ntp-doc-4.2.6p5-29.el7_8.2 [More...] |
NIST Vulnerability Database
OS: Redhat
An update for servicemesh-cni is now available for OpenShift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, |
An update for servicemesh-prometheus is now available for OpenShift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, |
An update for servicemesh-grafana is now available for OpenShift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, |
An update for servicemesh-proxy is now available for OpenShift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, |
NIST Vulnerability Database
CVEMAP.ORG: Vulnerabilities & Exposures
OS: Gentoo
An error in Cyrus IMAP Server allows mailboxes to be created with administrative privileges. |
Multiple vulnerabilities have been found in OpenJDK and IcedTea, the worst of which could result in the arbitrary execution of code. |
A vulnerability has been discovered in Apache Tomcat which could result in the arbitrary execution of code. |
A vulnerability was discovered in Asterisk which may allow local attackers to gain root privileges. |
OS: Fedora
Update to latest upstream version |
Update to version 26, a bugfix and security release. FIxes CVE-2020-14148. |
Update to 83.0.4103.116. Fixes CVE-2020-6509. ---- Black Lives Matter. Saying this does not mean that other lives do not matter. It should not be controversial to say this. If I say Chromium updates matter, it does not mean that other Fedora packages do not matter, it means that a Chromium update is needed to fix this giant pile of severe security vulnerabilities, here, today, |
Update to version 26, a bugfix and security release. FIxes CVE-2020-14148. |
OS: OpenSuse
An update that solves one vulnerability and has two fixes is now available. |
An update that fixes one vulnerability is now available. |
An update that solves two vulnerabilities and has one errata is now available. |
An update that solves 16 vulnerabilities and has 117 fixes is now available. |
OS: Arch
The package tomcat8 before version 8.5.56-1 is vulnerable to denial of service. |
The package freerdp before version 2:2.1.2-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. |
The package imagemagick before version 7.0.10.20-1 is vulnerable to information disclosure. |
The package bind before version 9.16.4-1 is vulnerable to denial of service. |
OS: Ubuntu
Several security issues were fixed in Thunderbird. |
Cinder and os-brick could be made to expose sensitive information. |
NSS could be made to expose sensitive information. |
OpenEXR could be made to crash or run programs if it opened a specially crafted file. |
OS: Debian
Several vulnerabilities have been discovered in the interpreter for the Ruby language. CVE-2020-10663 |
It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not properly sanitize incoming mail messages. This would allow a remote attacker to perform a Cross-Side Scripting (XSS) attack. |
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in information disclosure, denial of service or potentially the execution of arbitrary code. |
Multiple security issues have been found in Thunderbird which could result in denial of service or potentially the execution of arbitrary code. |
Exploit-DB.com
OS: CentOS
Upstream details at : https://access.redhat.com/errata/RHSA-2020:2824 |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:2827 |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:2664 |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:2663 |
OS: Mageia
Updated pdns-recursor package fixes security vulnerability: An issue has been found in PowerDNS Recursor where the ACL applied to the internal web server via webserver-allow-from is not properly enforced, allowing a remote attacker to send HTTP queries to the internal web server, |
Updated ruby packages fix security vulnerability: An issue was discovered in Ruby through 2.5.7. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the |
Updated mariadb packages fix security vulnerabilities: Vulnerability in the MariaDB Client product of MariaDB (component: C API) Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MariaDB Client. |
Updated libvirt packages fix security vulnerability: A flaw was found in the way the libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest, where it holds a monitor job while issuing the 'suspend' command to a guest-agent. |
OS: Suse
An update that fixes four vulnerabilities is now available. |
An update that fixes two vulnerabilities is now available. |
An update that fixes one vulnerability is now available. |
An update that fixes one vulnerability is now available. |
OS: Slackware
New seamonkey packages are available for Slackware 14.2 and -current to fix security issues. |
New libvorbis packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. |
New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. |
New libjpeg-turbo packages are available for Slackware 14.2 and -current to fix a security issue. |
OS: Debian LTS
Two vulnerabilities have been discovered in mutt, a console email client. CVE-2020-14093 |
Two vulnerabilities have been discovered in mutt, a console email client. CVE-2020-14093 |
In libmatio, a library to read and write Matlab MAT files, a vulnerability was fixed in Mat_VarReadNextInfo4 in mat4.c that could lead to a heap-based buffer over-read in strdup_vprintf. |
Several vulnerabilities were fixed in nss, the Network Security Service libraries. CVE-2020-12399 |