Hírolvasó

NVD: all CVE · 4 óra 14 perc

CVE-2020-8603

A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
NVD: all CVE · 4 óra 14 perc

CVE-2020-8604

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations.
NVD: all CVE · 4 óra 14 perc

CVE-2020-8605

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this vulnerability.
NVD: all CVE · 4 óra 14 perc

CVE-2020-8606

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance.
NVD: all CVE · 5 óra 14 perc

CVE-2020-11075

In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user via a valid API request to anchore engine, or if an already added image that anchore is monitoring has its manifest altered to exploit the same flaw. A successful attack can be used to execute commands that run in the analyzer environment, with the same permissions as the user that anchore engine is run as - including access to the credentials that Engine uses to access its own database which have read-write ability, as well as access to the running engien analyzer service environment. By default Anchore Engine is released and deployed as a container where the user is non-root, but if users run Engine directly or explicitly set the user to 'root' then that level of access may be gained in the execution environment where Engine runs. This issue is fixed in version 0.7.1.
NVD: all CVE · 2020. május 27.

CVE-2020-11059

In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle published to npm. This has been fixed in 21.10.1.
Linux security Advisories · 2020. május 27.

SUSE: 2020:1493-1 libmspack>

An update that solves one vulnerability and has one errata is now available.
NVD: all CVE · 2020. május 27.

CVE-2020-10936

Sympa before 6.2.56 allows privilege escalation.
Ubuntu Secutity Notices · 2020. május 27.

USN-4375-1: PHP vulnerability

php5, php7.0, php7.2, php7.3, php7.4 vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 20.04 LTS
  • Ubuntu 19.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 ESM
  • Ubuntu 12.04 ESM
Summary

PHP could be made to crash if it received a specially crafted file.

Software Description
  • php7.4 - server-side, HTML-embedded scripting language (metapackage)
  • php7.3 - server-side, HTML-embedded scripting language (metapackage)
  • php7.2 - HTML-embedded scripting language interpreter
  • php7.0 - HTML-embedded scripting language interpreter
  • php5 - HTML-embedded scripting language interpreter
Details

It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04 LTS
libapache2-mod-php7.4 - 7.4.3-4ubuntu2.2
php7.4-cgi - 7.4.3-4ubuntu2.2
php7.4-cli - 7.4.3-4ubuntu2.2
php7.4-fpm - 7.4.3-4ubuntu2.2
php7.4-mbstring - 7.4.3-4ubuntu2.2
Ubuntu 19.10
libapache2-mod-php7.3 - 7.3.11-0ubuntu0.19.10.6
php7.3-cgi - 7.3.11-0ubuntu0.19.10.6
php7.3-cli - 7.3.11-0ubuntu0.19.10.6
php7.3-fpm - 7.3.11-0ubuntu0.19.10.6
php7.3-mbstring - 7.3.11-0ubuntu0.19.10.6
Ubuntu 18.04 LTS
libapache2-mod-php7.2 - 7.2.24-0ubuntu0.18.04.6
php7.2-cgi - 7.2.24-0ubuntu0.18.04.6
php7.2-cli - 7.2.24-0ubuntu0.18.04.6
php7.2-fpm - 7.2.24-0ubuntu0.18.04.6
php7.2-mbstring - 7.2.24-0ubuntu0.18.04.6
Ubuntu 16.04 LTS
libapache2-mod-php7.0 - 7.0.33-0ubuntu0.16.04.15
php7.0-cgi - 7.0.33-0ubuntu0.16.04.15
php7.0-cli - 7.0.33-0ubuntu0.16.04.15
php7.0-fpm - 7.0.33-0ubuntu0.16.04.15
php7.0-mbstring - 7.0.33-0ubuntu0.16.04.15
Ubuntu 14.04 ESM
libapache2-mod-php5 - 5.5.9+dfsg-1ubuntu4.29+esm12
php5-cgi - 5.5.9+dfsg-1ubuntu4.29+esm12
php5-cli - 5.5.9+dfsg-1ubuntu4.29+esm12
php5-fpm - 5.5.9+dfsg-1ubuntu4.29+esm12
Ubuntu 12.04 ESM
libapache2-mod-php5 - 5.3.10-1ubuntu3.47
php5-cgi - 5.3.10-1ubuntu3.47
php5-cli - 5.3.10-1ubuntu3.47
php5-fpm - 5.3.10-1ubuntu3.47

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References
NVD: all CVE · 2020. május 27.

CVE-2020-6774

Improper Access Control in the Kiosk Mode functionality of Bosch Recording Station allows a local unauthenticated attacker to escape from the Kiosk Mode and access the underlying operating system.
Linux security Advisories · 2020. május 27.

Mageia 2020-0238: libexif security update>

The updated packages fix a security vulnerability: In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed.
Linux security Advisories · 2020. május 27.

Mageia 2020-0237: ant security update>

Updated ant packages fix security vulnerability: Apache Ant uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy
Linux security Advisories · 2020. május 27.

Mageia 2020-0236: php security update>

Updated php packages fix security vulnerabilities: - Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). [1] - Fixed bug #78876 (Long variables in multipart/form-data cause OOM and
NVD: fully analised CVE · 2020. május 27.

CVE-2020-13633 (fork_cms)

Fork before 5.8.3 allows XSS via navigation_title or title.
NVD: all CVE · 2020. május 27.

CVE-2020-13633

Fork before 5.8.3 allows XSS via navigation_title or title.
NVD: all CVE · 2020. május 27.

CVE-2020-10945

Centreon before 19.10.7 exposes Session IDs in server responses.
NVD: all CVE · 2020. május 27.

CVE-2020-10946

Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
NVD: all CVE · 2020. május 27.

CVE-2020-13627

Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
NVD: all CVE · 2020. május 27.

CVE-2020-13628

Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
Linux security Advisories · 2020. május 27.

Ubuntu 4375-1: PHP vulnerability>

PHP could be made to crash if it received a specially crafted file.