Thank you for reading the Linux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system. Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available.
| |
Debian: DSA-4647-1: bluez security update (Mar 26) |
| |
It was reported that the BlueZ's HID and HOGP profile implementations don't specifically require bonding between the device and the host. Malicious devices can take advantage of this flaw to connect to a target host and impersonate an existing HID device without security or to cause
|
| |
Debian: DSA-4646-1: icu security update (Mar 25) |
| |
Andre Bargull discovered an integer overflow in the International Components for Unicode (ICU) library which could result in denial of service and potentially the execution of arbitrary code.
|
| |
Debian: DSA-4645-1: chromium security update (Mar 22) |
| |
Several vulnerabilities have been discovered in the chromium web browser. CVE-2019-20503
|
| |
Debian: DSA-4644-1: tor security update (Mar 20) |
| |
A denial of service vulnerability (by triggering high CPU consumption) was found in Tor, a connection-based low-latency anonymous communication system.
|
| |
Debian: DSA-4643-1: python-bleach security update (Mar 20) |
| |
It was reported that python-bleach, a whitelist-based HTML-sanitizing library, is prone to a mutation XSS vulnerability in bleach.clean when strip=False and 'math' or 'svg' tags and one or more of the RCDATA tags were whitelisted.
|
| |
Debian: DSA-4642-1: thunderbird security update (Mar 19) |
| |
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code. For the oldstable distribution (stretch), these problems have been fixed
|
|
|
| |
Fedora 31: kernel FEDORA-2020-76966b3419 (Mar 27) |
| |
The 5.5.11 stable kernel update contains a number of important fixes across the tree.
|
| |
Fedora 31: PyYAML FEDORA-2020-bdb0bfa928 (Mar 27) |
| |
* New upstream release 5.3.1 (rhbz#1814882) * Fixes CVE-2020-1747 (rhbz#1807367,1809011)
|
| |
Fedora 30: chromium FEDORA-2020-39e0b8bd14 (Mar 27) |
| |
Update to 80.0.3987.149. Upstream says it fixes "13" security issues, but only lists these CVEs: * CVE-2020-6422: Use after free in WebGL * CVE-2020-6424: Use after free in media * CVE-2020-6425: Insufficient policy enforcement in extensions. * CVE-2020-6426: Inappropriate implementation in V8 * CVE-2020-6427: Use after free in audio * CVE-2020-6428: Use after free in audio
|
| |
Fedora 30: PyYAML FEDORA-2020-40c35d7b37 (Mar 27) |
| |
* New upstream release 5.3.1 (rhbz#1814882) * Fixes CVE-2020-1747 (rhbz#1807367,1809011)
|
| |
Fedora 32: chromium FEDORA-2020-17149a4f3d (Mar 27) |
| |
Update to 80.0.3987.149. Upstream says it fixes "13" security issues, but only lists these CVEs: * CVE-2020-6422: Use after free in WebGL * CVE-2020-6424: Use after free in media * CVE-2020-6425: Insufficient policy enforcement in extensions. * CVE-2020-6426: Inappropriate implementation in V8 * CVE-2020-6427: Use after free in audio * CVE-2020-6428: Use after free in audio
|
| |
Fedora 30: php FEDORA-2020-ce5a2a7403 (Mar 26) |
| |
**PHP version 7.3.16** (19 Mar 2020) **Core:** * Fixed bug php#63206 (restore_error_handler does not restore previous errors mask). (Mark Plomer) **DOM:** * Fixed bug php#77569: (Write Access Violation in DomImplementation). (Nikita, cmb) * Fixed bug php#79271 (DOMDocumentType::$childNodes is NULL). (cmb) **Enchant:** * Fixed bug php#79311 (enchant_dict_suggest() fails on big
|
| |
Fedora 30: libxslt FEDORA-2020-40fa1ae94b (Mar 26) |
| |
Security and performance fixes.
|
| |
Fedora 31: php FEDORA-2020-0bf228857a (Mar 25) |
| |
**PHP version 7.3.16** (19 Mar 2020) **Core:** * Fixed bug php#63206 (restore_error_handler does not restore previous errors mask). (Mark Plomer) **DOM:** * Fixed bug php#77569: (Write Access Violation in DomImplementation). (Nikita, cmb) * Fixed bug php#79271 (DOMDocumentType::$childNodes is NULL). (cmb) **Enchant:** * Fixed bug php#79311 (enchant_dict_suggest() fails on big
|
| |
Fedora 32: php FEDORA-2020-9aac6c76c4 (Mar 25) |
| |
**PHP version 7.4.4** (19 Mar 2020) **Core:** * Fixed bug php#79329 (get_headers() silently truncates after a null byte) (**CVE-2020-7066**) (cmb) * Fixed bug php#79244 (php crashes during parsing INI file). (Laruence) * Fixed bug php#63206 (restore_error_handler does not restore previous errors mask). (Mark Plomer) **CURL:** * Fixed bug php#79019 (Copied cURL handles upload
|
| |
Fedora 31: webkit2gtk3 FEDORA-2020-f25793aac4 (Mar 24) |
| |
Update to WebKitGTK 2.28.0. * Add API to enable Process Swap on (Cross-site) Navigation. * Add user messages API for the communication with the web extension. * Add support for same-site cookies. * Service workers are enabled by default. * Add support for Pointer Lock API. * Add flatpak sandbox support. * Make ondemand hardware acceleration policy never leave accelerated compositing
|
| |
Fedora 32: java-1.8.0-openjdk FEDORA-2020-42e79d74f1 (Mar 24) |
| |
Update Fedora 32 to the final release version of 8u242 (http://bitly.com/oj8u242) bringing in the last security updates, in line with packages already in Fedora 30 & 31 This also resolves RHBZ#1813550 which was seen with the previous attempt at this update.
|
| |
Fedora 31: okular FEDORA-2020-7036f54316 (Mar 23) |
| |
Security fix for CVE-2020-9359
|
| |
Fedora 31: chromium FEDORA-2020-7fd051b378 (Mar 23) |
| |
Update to 80.0.3987.149. Upstream says it fixes "13" security issues, but only lists these CVEs: * CVE-2020-6422: Use after free in WebGL * CVE-2020-6424: Use after free in media * CVE-2020-6425: Insufficient policy enforcement in extensions. * CVE-2020-6426: Inappropriate implementation in V8 * CVE-2020-6427: Use after free in audio * CVE-2020-6428: Use after free in audio
|
| |
Fedora 31: chromium FEDORA-2020-f6271d7afa (Mar 19) |
| |
Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA. List of CVEs fixed (since last update): * CVE-2019-20446 * CVE-2020-6381 * CVE-2020-6382 * CVE-2020-6383 * CVE-2020-6384 * CVE-2020-6385 * CVE-2020-6386 * CVE-2020-6387 * CVE-2020-6388 * CVE-2020-6389 * CVE-2020-6390 * CVE-2020-6391 * CVE-2020-6392 *
|
| |
Fedora 30: webkit2gtk3 FEDORA-2020-f3fa778924 (Mar 19) |
| |
Update to WebKitGTK 2.28.0. * Add API to enable Process Swap on (Cross-site) Navigation. * Add user messages API for the communication with the web extension. * Add support for same-site cookies. * Service workers are enabled by default. * Add support for Pointer Lock API. * Add flatpak sandbox support. * Make ondemand hardware acceleration policy never leave accelerated compositing
|
| |
Fedora 32: libarchive FEDORA-2020-235688c222 (Mar 19) |
| |
Automatic update for libarchive-3.4.2-1.fc32.
|
|
|
| |
Gentoo: GLSA-202003-61: Adobe Flash Player: Remote execution of arbitrary code (Mar 26) |
| |
A vulnerability in Adobe Flash Player might allow remote attackers to execute arbitrary code.
|
| |
Gentoo: GLSA-202003-60: QtCore: Multiple vulnerabilities (Mar 26) |
| |
Multiple vulnerabilities have been found in QtCore, the worst of which could result in the execution of arbitrary code.
|
| |
Gentoo: GLSA-202003-59: libvpx: User-assisted execution of arbitrary code (Mar 26) |
| |
Multiple vulnerabilities have been found in libvpx, the worst of which could result in the execution of arbitrary code.
|
| |
Gentoo: GLSA-202003-58: UnZip: User-assisted execution of arbitrary code (Mar 26) |
| |
Multiple vulnerabilities have been found in UnZip, the worst of which could result in the execution of arbitrary code.
|
| |
Gentoo: GLSA-202003-57: PHP: Multiple vulnerabilities (Mar 26) |
| |
Multiple vulnerabilities have been found in PHP, the worst of which could result in the execution of arbitrary shell commands.
|
| |
Gentoo: GLSA-202003-56: Xen: Multiple vulnerabilities (Mar 25) |
| |
Multiple vulnerabilities have been found in Xen, the worst of which could allow for privilege escalation.
|
| |
Gentoo: GLSA-202003-55: Zsh: Privilege escalation (Mar 25) |
| |
A vulnerability in Zsh might allow an attacker to escalate privileges.
|
| |
Gentoo: GLSA-202003-54: Pure-FTPd: Multiple vulnerabilities (Mar 25) |
| |
Multiple vulnerabilities have been found in Pure-FTPd, the worst of which could allow remote attackers to cause a Denial of Service condition. [More...]
|
| |
Gentoo: GLSA-202003-53: Chromium, Google Chrome: Multiple vulnerabilities (Mar 25) |
| |
Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could allow remote attackers to execute arbitrary code. [More...]
|
| |
Gentoo: GLSA-202003-52: Samba: Multiple vulnerabilities (Mar 25) |
| |
Multiple vulnerabilities have been found in Samba, the worst of which could lead to remote code execution.
|
| |
Gentoo: GLSA-202003-51: WeeChat: Multiple vulnerabilities (Mar 25) |
| |
Multiple vulnerabilities have been found in WeeChat, the worst of which could allow remote attackers to cause a Denial of Service condition.
|
| |
Gentoo: GLSA-202003-50: Tor: Multiple vulnerabilities (Mar 25) |
| |
Multiple vulnerabilities were found in Tor, the worst of which could allow remote attackers to cause a Denial of Service condition.
|
| |
Gentoo: GLSA-202003-49: BlueZ: Security bypass (Mar 25) |
| |
A vulnerability in BlueZ might allow remote attackers to bypass security restrictions.
|
| |
Gentoo: GLSA-202003-48: Node.js: Multiple vulnerabilities (Mar 20) |
| |
Multiple vulnerabilities have been found in Node.js, worst of which could allow remote attackers to write arbitrary files.
|
| |
Gentoo: GLSA-202003-47: Exim: Heap-based buffer overflow (Mar 20) |
| |
A vulnerability in Exim could allow a remote attacker to execute arbitrary code.
|
| |
Gentoo: GLSA-202003-46: ClamAV: Multiple vulnerabilities (Mar 19) |
| |
Multiple vulnerabilities have been found in ClamAV, the worst of which could result in a Denial of Service condition.
|
| |
Gentoo: GLSA-202003-45: PyYAML: Arbitrary code execution (Mar 19) |
| |
A flaw in PyYAML might allow attackers to execute arbitrary code.
|
| |
Gentoo: GLSA-202003-44: Binary diff: Heap-based buffer overflow (Mar 19) |
| |
A heap-based buffer overflow in Binary diff might allow remote attackers to execute arbitrary code.
|
| |
Gentoo: GLSA-202003-43: Apache Tomcat: Multiple vulnerabilities (Mar 19) |
| |
Multiple vulnerabilities have been found in Apache Tomcat, the worst of which could lead to arbitrary code execution.
|
| |
Gentoo: GLSA-202003-42: libgit2: Multiple vulnerabilities (Mar 19) |
| |
Multiple vulnerabilities have been found in libgit2, the worst of which could result in the arbitrary execution of code.
|
| |
Gentoo: GLSA-202003-41: GNU FriBidi: Heap-based buffer overflow (Mar 19) |
| |
A heap-based buffer overflow in GNU FriBidi might allow remote attackers to execute arbitrary code.
|
| |
Gentoo: GLSA-202003-40: Cacti: Multiple vulnerabilities (Mar 19) |
| |
Multiple vulnerabilities have been found in Cacti, the worst of which could lead to the remote execution of arbitrary code.
|
| |
Gentoo: GLSA-202003-39: phpMyAdmin: SQL injection (Mar 19) |
| |
An SQL injection vulnerability in phpMyAdmin may allow attackers to execute arbitrary SQL statements.
|
| |
Gentoo: GLSA-202003-38: PECL Imagick: Arbitrary code execution (Mar 19) |
| |
A vulnerability in Imagick PHP extension might allow an attacker to execute arbitrary code.
|
|
|
| |
RedHat: RHSA-2020-0984:01 Important: ipmitool security update (Mar 26) |
| |
An update for ipmitool is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-0983:01 Important: Red Hat Fuse 7.6.0 security update (Mar 26) |
| |
A minor version update (from 7.5 to 7.6) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact
|
| |
RedHat: RHSA-2020-0981:01 Important: ipmitool security update (Mar 26) |
| |
An update for ipmitool is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-0980:01 Moderate: rh-postgresql10-postgresql security (Mar 26) |
| |
An update for rh-postgresql10-postgresql is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0979:01 Important: ipmitool security update (Mar 26) |
| |
An update for ipmitool is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0978:01 Important: zsh security update (Mar 26) |
| |
An update for zsh is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0830:01 Moderate: OpenShift Container Platform 4.2 (Mar 26) |
| |
An update for openshift-enterprise-mediawiki-container is now available for Red Hat OpenShift Container Platform 4.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0964:01 Important: OpenShift Container Platform 3.11 (Mar 25) |
| |
An update for jenkins-2-plugins is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0975:01 Moderate: Red Hat OpenShift Service Mesh 1.0.10 (Mar 25) |
| |
An update for openshift-istio-kiali-rhel7-operator-container is now available for Openshift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0972:01 Moderate: Red Hat OpenShift Service Mesh 1.0.10 (Mar 25) |
| |
An update for Jaeger and Kiali is now available for Openshift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0866:01 Moderate: OpenShift Container Platform 4.3.8 (Mar 24) |
| |
An update for openshift-enterprise-template-service-broker-operator-container is now available for Red Hat OpenShift Container Platform 4.3. Red Hat Product Security has rated this update as having a security impact
|
| |
RedHat: RHSA-2020-0863:01 Moderate: OpenShift Container Platform 4.3.8 (Mar 24) |
| |
An update for openshift-enterprise-builder-container, openshift-enterprise-cli-container, and ose-cli-artifacts-container is now available for Red Hat OpenShift Container Platform 4.3. Red Hat Product Security has rated this update as having a security impact
|
| |
RedHat: RHSA-2020-0928:01 Moderate: OpenShift Container Platform 4.3.8 (Mar 24) |
| |
An update for openshift-clients is now available for Red Hat OpenShift Container Platform 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0962:01 Important: Red Hat JBoss Enterprise Application (Mar 24) |
| |
An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0961:01 Important: Red Hat JBoss Enterprise Application (Mar 24) |
| |
An update is now available for Red Hat JBoss Enterprise Application Platform 7.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0952:01 Critical: Red Hat Single Sign-On 7.3.7 security (Mar 23) |
| |
A security update is now available for Red Hat Single Sign-On 7.3 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0951:01 Important: Red Hat Single Sign-On 7.3.7 security (Mar 23) |
| |
A security update is now available for Red Hat Single Sign-On 7.3 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0946:01 Important: Red Hat Single Sign-On 7.3.7 security (Mar 23) |
| |
New Red Hat Single Sign-On 7.3.7 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0945:01 Important: Red Hat Single Sign-On 7.3.7 security (Mar 23) |
| |
New Red Hat Single Sign-On 7.3.7 packages are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0947:01 Important: Red Hat Single Sign-On 7.3.7 security (Mar 23) |
| |
New Red Hat Single Sign-On 7.3.7 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0943:01 Moderate: samba security and bug fix update (Mar 23) |
| |
An update for samba is now available for Red Hat Gluster Storage 3.5 on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0942:01 Moderate: runc security update (Mar 23) |
| |
An update for runc is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
|
| |
RedHat: RHSA-2020-0939:01 Important: Red Hat AMQ Streams 1.4.0 release and (Mar 23) |
| |
Red Hat AMQ Streams 1.4.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0924:01 Moderate: devtoolset-8-gcc security update (Mar 23) |
| |
An update for devtoolset-8-gcc is now available for Red Hat Developer Toolset 8 for Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0914:01 Important: thunderbird security update (Mar 23) |
| |
An update for thunderbird is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-0920:01 Important: libvncserver security update (Mar 23) |
| |
An update for libvncserver is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-0913:01 Important: libvncserver security update (Mar 23) |
| |
An update for libvncserver is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-0912:01 Important: tomcat6 security update (Mar 23) |
| |
An update for tomcat6 is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-0919:01 Important: thunderbird security update (Mar 23) |
| |
An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-0921:01 Important: libvncserver security update (Mar 23) |
| |
An update for libvncserver is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0918:01 Important: thunderbird security update (Mar 23) |
| |
An update for thunderbird is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0922:01 Important: Red Hat AMQ Broker 7.6 release and (Mar 23) |
| |
Red Hat AMQ Broker 7.6 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-0801:01 Moderate: OpenShift Container Platform 3.11 (Mar 19) |
| |
An update for openshift-enterprise-postgresql-apb is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0802:01 Moderate: OpenShift Container Platform 3.11 (Mar 19) |
| |
An update for openshift-enterprise-mariadb-apb is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0798:01 Moderate: OpenShift Container Platform 3.11 (Mar 19) |
| |
An update for openshift-enterprise-mediawiki-apb is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0803:01 Moderate: OpenShift Container Platform 3.11 (Mar 19) |
| |
An update for jenkins-slave-base-rhel7-container is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0800:01 Moderate: OpenShift Container Platform 3.11 (Mar 19) |
| |
An update for openshift-enterprise-mysql-apb is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0799:01 Moderate: OpenShift Container Platform 3.11 (Mar 19) |
| |
An update for openshift-enterprise-mediawiki-container is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0796:01 Moderate: OpenShift Container Platform 3.11 (Mar 19) |
| |
An update for openshift-enterprise-apb-base-container is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-0795:01 Moderate: OpenShift Container Platform 3.11 (Mar 19) |
| |
Red Hat OpenShift Container Platform release 3.11.188 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-0905:01 Important: thunderbird security update (Mar 19) |
| |
An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-0903:01 Important: zsh security update (Mar 19) |
| |
An update for zsh is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-0902:01 Important: icu security update (Mar 19) |
| |
An update for icu is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-0901:01 Important: icu security update (Mar 19) |
| |
An update for icu is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
|
|
| |
Slackware: 2020-086-01: Slackware 14.2 kernel Security Update (Mar 26) |
| |
New kernel packages are available for Slackware 14.2 to fix security issues.
|
| |
Slackware: 2020-083-01: gd Security Update (Mar 23) |
| |
New gd packages are available for Slackware 14.2 and -current to fix security issues.
|
|
|
| |
SUSE: 2020:14334-1 important: tomcat6 (Mar 27) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0801-1 moderate: ldns (Mar 26) |
| |
An update that fixes two vulnerabilities is now available.
|
| |
SUSE: 2020:0792-1 moderate: python-cffi, python-cryptography (Mar 25) |
| |
An update that solves one vulnerability and has 6 fixes is now available.
|
| |
SUSE: 2020:0790-1 moderate: python-cffi, python-cryptography, python-xattr (Mar 25) |
| |
An update that solves one vulnerability and has 6 fixes is now available.
|
| |
SUSE: 2020:0779-1 important: keepalived (Mar 24) |
| |
An update that solves three vulnerabilities and has one errata is now available.
|
| |
SUSE: 2020:0762-1 important: Security Beta Salt (Mar 24) |
| |
An update that solves one vulnerability and has four fixes is now available.
|
| |
SUSE: 2020:14332-1 important: Security Beta Salt (Mar 24) |
| |
An update that solves one vulnerability and has four fixes is now available.
|
| |
SUSE: 2020:0763-1 important: Security Beta Salt (Mar 24) |
| |
An update that solves one vulnerability and has four fixes is now available.
|
| |
SUSE: 2020:14331-1 important: Security Beta Salt (Mar 24) |
| |
An update that solves one vulnerability and has four fixes is now available.
|
| |
SUSE: 2020:0750-1 moderate: python36 (Mar 23) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0743-1 moderate: strongswan (Mar 23) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0751-1 moderate: cloud-init (Mar 23) |
| |
An update that solves two vulnerabilities and has one errata is now available.
|
| |
SUSE: 2020:0752-1 moderate: postgresql10 (Mar 23) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0737-1 important: Recommended ruby2.5 (Mar 20) |
| |
An update that fixes 7 vulnerabilities is now available.
|
| |
SUSE: 2020:0725-1 important: tomcat (Mar 19) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0721-1 important: MozillaThunderbird (Mar 19) |
| |
An update that fixes 7 vulnerabilities is now available.
|
| |
SUSE: 2020:0722-1 moderate: nghttp2 (Mar 19) |
| |
An update that solves one vulnerability and has one errata is now available.
|
| |
SUSE: 2020:0717-1 important: MozillaFirefox (Mar 19) |
| |
An update that fixes 7 vulnerabilities is now available.
|
|
|
| |
Ubuntu 4134-3: IBus vulnerability (Mar 24) |
| |
IBus could allow local users to capture key strokes of other locally logged in users.
|
| |
Ubuntu 4309-1: Vim vulnerabilities (Mar 23) |
| |
Several security issues were fixed in Vim.
|
| |
Ubuntu 4308-1: Twisted vulnerabilities (Mar 19) |
| |
Several security issues were fixed in Twisted.
|
| |
Ubuntu 0064-1: Linux kernel vulnerability (Mar 19) |
| |
Several security issues were fixed in the kernel.
|
|
|
| |
Debian LTS: DLA-2160-1: php5 security update (Mar 26) |
| |
Two security issues have been identified and fixed in php5, a server-side, HTML-embedded scripting language.
|
| |
Debian LTS: DLA-2159-1: okular security update (Mar 25) |
| |
Mickael Karatekin from Sysdream Labs discovered that the Okular document viewer allows code execution via an action link in a PDF document.
|
| |
Debian LTS: DLA-2158-1: ruby2.1 security update (Mar 25) |
| |
An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer "head" allocation is made based on
|
| |
Debian LTS: DLA-2157-1: weechat security update (Mar 24) |
| |
Several issues have been found in weechat, a fast, light and extensible chat client. All issues are about crafted messages, that could result in
|
| |
Debian LTS: DLA-2156-1: e2fsprogs security update (Mar 24) |
| |
An issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities. A specially crafted ext4 directory can cause an out-of-bounds write on the
|
| |
Debian LTS: DLA-2155-1: tomcat8 security update (Mar 24) |
| |
Tomcat8 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle
|
| |
Debian LTS: DLA-2154-1: phpmyadmin security update (Mar 22) |
| |
The following packages CVE(s) were reported against phpmyadmin. CVE-2020-10802
|
| |
Debian LTS: DLA-2153-1: jackson-databind security update (Mar 22) |
| |
The following CVE(s) were reported against jackson-databind. CVE-2020-10672
|
| |
Debian LTS: DLA-2152-1: graphicsmagick security update (Mar 21) |
| |
A vulnerability was discovered in graphicsmagick, a collection of image processing tools, that allows allows an attacker to read arbitrary files via a crafted image because of TranslateTextEx for SVG.
|
| |
Debian LTS: DLA-2148-1: amd64-microcode security update (Mar 20) |
| |
It was discovered that systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local
|
| |
Debian LTS: DLA-2149-1: rails security update (Mar 20) |
| |
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers.
|
| |
Debian LTS: DLA-2145-2: twisted security update (Mar 19) |
| |
It was discovered that there were was a regression introduced in DLA-2145-1 due to the incorrect application of the upstream patch for CVE-2020-10108 & CVE-2020-10109 regarding a number of HTTP request splitting vulnerabilities in Twisted, an Python event-based framework
|
|
|
| |
ArchLinux: 202003-13: bluez: access restriction bypass (Mar 20) |
| |
The package bluez before version 5.54-1 is vulnerable to access restriction bypass.
|
| |
ArchLinux: 202003-12: chromium: multiple issues (Mar 20) |
| |
The package chromium before version 80.0.3987.149-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution and information disclosure.
|
|
|
| |
CentOS: CESA-2020-0898: Important CentOS 6 python-imaging (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0898
|
| |
CentOS: CESA-2020-0892: Important CentOS 6 zsh (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0892
|
| |
CentOS: CESA-2020-0896: Important CentOS 6 icu (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0896
|
| |
CentOS: CESA-2020-0912: Important CentOS 6 tomcat6 (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0912
|
| |
CentOS: CESA-2020-0816: Important CentOS 6 firefox (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0816
|
| |
CentOS: CESA-2020-0914: Important CentOS 6 thunderbird (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0914
|
| |
CentOS: CESA-2020-0815: Important CentOS 7 firefox (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0815
|
| |
CentOS: CESA-2020-0905: Important CentOS 7 thunderbird (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0905
|
| |
CentOS: CESA-2020-0897: Important CentOS 7 icu (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0897
|
| |
CentOS: CESA-2020-0913: Important CentOS 7 libvncserver (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0913
|
| |
CentOS: CESA-2020-0851: Moderate CentOS 7 python-virtualenv (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0851
|
| |
CentOS: CESA-2020-0855: Important CentOS 7 tomcat (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0855
|
| |
CentOS: CESA-2020-0853: Important CentOS 7 zsh (Mar 25) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:0853
|
|
|
| |
SciLinux: SLSA-2020-0914-1 Important: thunderbird on SL6.x i386/x86_64 (Mar 23) |
| |
Mozilla: Use-after-free when removing data about origins (CVE-2020-6805) * Mozilla: BodyStream::OnInputStreamReady was missing protections against state confusion (CVE-2020-6806) * Mozilla: Use-after-free in cubeb during stream destruction (CVE-2020-6807) * Mozilla: Memory safety bugs fixed in Firefox 74 and Firefox ESR 68.6 (CVE-2020-6814) * Mozilla: Out of bounds reads in sctp_load_addre [More...]
|
| |
SciLinux: SLSA-2020-0912-1 Important: tomcat6 on SL6.x (noarch) (Mar 23) |
| |
tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability (CVE-2020-1938) SL6 noarch tomcat6-6.0.24-114.el6_10.noarch.rpm tomcat6-admin-webapps-6.0.24-114.el6_10.noarch.rpm tomcat6-docs-webapp-6.0.24-114.el6_10.noarch.rpm tomcat6-el-2.1-api-6.0.24-114.el6_10.noarch.rpm tomcat6-javadoc-6.0.24-114.el6_10.noarch.rpm tomcat6-jsp-2.1-api-6.0.24-114.el6_10.noarch.rpm [More...]
|
| |
SciLinux: SLSA-2020-0913-1 Important: libvncserver on SL7.x x86_64 (Mar 23) |
| |
libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow (CVE-2019-15690) SL7 x86_64 libvncserver-0.9.9-14.el7_7.i686.rpm libvncserver-0.9.9-14.el7_7.x86_64.rpm libvncserver-debuginfo-0.9.9-14.el7_7.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_7.x86_64.rpm libvncserver-devel-0.9.9-14.el7_7.i686.rpm libvncserver-devel-0.9.9-14.el7_7.x [More...]
|
| |
SciLinux: SLSA-2020-0905-1 Important: thunderbird on SL7.x x86_64 (Mar 19) |
| |
Mozilla: Use-after-free when removing data about origins (CVE-2020-6805) * Mozilla: BodyStream::OnInputStreamReady was missing protections against state confusion (CVE-2020-6806) * Mozilla: Use-after-free in cubeb during stream destruction (CVE-2020-6807) * Mozilla: Memory safety bugs fixed in Firefox 74 and Firefox ESR 68.6 (CVE-2020-6814) * Mozilla: Out of bounds reads in sctp_load_addre [More...]
|
|
|
| |
openSUSE: 2020:0388-1: important: the Linux Kernel (Mar 27) |
| |
An update that solves four vulnerabilities and has 37 fixes is now available.
|
| |
openSUSE: 2020:0391-1: moderate: mcpp (Mar 27) |
| |
An update that fixes one vulnerability is now available.
|
| |
openSUSE: 2020:0389-1: important: chromium (Mar 27) |
| |
An update that fixes 9 vulnerabilities is now available.
|
| |
openSUSE: 2020:0376-1: moderate: apache2-mod_auth_openidc (Mar 25) |
| |
An update that fixes one vulnerability is now available.
|
| |
openSUSE: 2020:0377-1: moderate: skopeo (Mar 25) |
| |
An update that solves one vulnerability and has one errata is now available.
|
| |
openSUSE: 2020:0379-1: moderate: nghttp2 (Mar 25) |
| |
An update that solves one vulnerability and has one errata is now available.
|
| |
openSUSE: 2020:0381-1: moderate: glibc (Mar 25) |
| |
An update that solves one vulnerability and has two fixes is now available.
|
| |
openSUSE: 2020:0382-1: moderate: mcpp (Mar 25) |
| |
An update that fixes one vulnerability is now available.
|
| |
openSUSE: 2020:0368-1: moderate: texlive-filesystem (Mar 23) |
| |
An update that contains security fixes can now be installed.
|
| |
openSUSE: 2020:0366-1: important: MozillaThunderbird (Mar 22) |
| |
An update that fixes 7 vulnerabilities is now available.
|
| |
openSUSE: 2020:0365-1: important: chromium (Mar 22) |
| |
An update that fixes 9 vulnerabilities is now available.
|
| |
openSUSE: 2020:0362-1: moderate: wireshark (Mar 19) |
| |
An update that fixes 59 vulnerabilities is now available.
|
