VARIoT IoT vulnerabilities database

Cisco ACE A2(3.6) allows log retention DoS. An attacker could exploit this vulnerability by sending a large number of SSL connections to an affected device to exhaust the remaining free space on the hard drive, causing a denial of service

MOXA MB3180 / MB3280 / MB3480 series is an advanced Ethernet gateway device produced by Taiwan moxa Technology Co., Ltd. The MOXA MB3180 / MB3280 / MB3480 series of advanced Ethernet gateways have information disclosure vulnerabilities. Attackers can use the vulnerabilities to launch further attacks.

MOXA MGate is a serial communication server produced by Taiwan moxa Technology Co., Ltd. The moxa mb3180 / mb3280 / mb3480 series serial communication server has an unauthorized access vulnerability. An attacker can use this vulnerability to reset the system IP, password, and restart the system.

MikroTik WinBox before 3.21 is vulnerable to a path traversal vulnerability that allows creation of arbitrary files wherevere WinBox has write permissions. WinBox is vulnerable to this attack if it connects to a malicious endpoint or if an attacker mounts a man in the middle attack. MikroTik WinBox Exists in a past traversal vulnerability.Information may be tampered with

An issue was discovered in OpServices OpMon 9.3.2. Without authentication, it is possible to read server files (e.g., /etc/passwd) due to the use of the nmap -iL (aka input file) option. OpServices OpMon There is a vulnerability in the lack of authentication for critical features.Information may be obtained. OpServices OpMon is an IT infrastructure monitoring software from Brazil. OpServices OpMon has security holes

Schmid ZI 620 V400 VPN 090 routers allow an attacker to execute OS commands as root via shell metacharacters to an entry on the SSH subcommand menu, as demonstrated by ping. Schmid ZI 620 V400 VPN The router has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Schmid ZI 620 V400 VPN 090 Router is a router device. The vulnerability stems from the process of externally inputting data to construct the executable command of the operating system, and the network system or product did not properly filter the special characters and commands in it. The vulnerability executes illegal operating system commands

An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution . OpServices OpMon There is a vulnerability in the lack of authentication for critical features.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state

On BIG-IP 15.0.0-15.0.1.1 and 14.1.0-14.1.2.2, while processing specifically crafted traffic using the default 'xnet' driver, Virtual Edition instances hosted in Amazon Web Services (AWS) may experience a TMM restart. plural BIG-IP The product contains an input verification vulnerability.Service operation interruption (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. A security vulnerability exists in the F5 BIG-IP. The vulnerability stems from the failure of the network system or product to properly validate the input data. No detailed vulnerability details were provided at this time

On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.0-11.6.5.1, the tmm crashes under certain circumstances when using the connector profile if a specific sequence of connections are made. BIG-IP There is an input verification vulnerability in.Service operation interruption (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. The vulnerability stems from the failure of the network system or product to properly validate the input data. The following products and versions are affected: F5 BIG-IP from version 15.0.0 to version 15.0.1.1, version 14.1.0 to version 14.1.2.2, version 14.0.0 to version 14.0.1, version 13.1.0 to version 13.1.3.1 , version 12.1.0 to version 12.1.5, version 11.6.0 to version 11.6.5.1

An issue was discovered in OpServices OpMon 9.3.2. Starting from the apache user account, it is possible to perform privilege escalation through the lack of correct configuration in the server's sudoers file, which by default allows the execution of programs (e.g. nmap) without the need for a password with sudo. OpServices OpMon Exists in a privilege management vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state

A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed. plural Bosch The product contains a past traversal vulnerability.Information may be obtained. Bosch DIVAR IP 3000 is a 3000 series video recorder from the German company Bosch (Bosch). The vulnerability stems from a network system or product failing to properly filter resources or special elements in the file path. An attacker can use this vulnerability to access a location outside the restricted directory

Dell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009 contain a Denial of Service vulnerability on NAS Server SSH implementation that is used to provide SFTP service on a NAS server. A remote unauthenticated attacker may potentially exploit this vulnerability and cause a Denial of Service (Storage Processor Panic) by sending an out of order SSH protocol sequence. EMC UnityVSA is a virtual EMC Unity storage environment

Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations. An attacker may exploit this vulnerability to gain access to restricted files. The non-RAN HTTP and WebDAV file-serving components have a vulnerability wherein when either are enabled, and Basic Authentication is enabled for either or both components, files are accessible without authentication. The following products and versions are affected: Dell EMC Isilon OneFS version 8.1.2, version 8.1.0.4, version 8.1.0.3, version 8.0.0.7

Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages. systemd Is vulnerable to the use of freed memory.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Systemd is a Linux-based system and service manager for German Lennart Poettering software developers. This product is compatible with SysV and LSB startup scripts, and provides a framework for expressing dependencies between system services. Systemd has a resource management error vulnerability, which originates from the improper management of system resources (such as memory, disk space, files, etc.) by network systems or products. No detailed vulnerability details are provided at this time. (CVE-2018-16888). Bug Fix(es): * systemd: systemctl reload command breaks ordering dependencies between units (BZ#1781712) 4. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: systemd security update Advisory ID: RHSA-2020:0564-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:0564 Issue date: 2020-02-20 CVE Names: CVE-2020-1712 ==================================================================== 1. Summary: An update for systemd is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS E4S (v. 8.0) - aarch64, ppc64le, s390x, x86_64 3. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd: use-after-free when asynchronous polkit queries are performed (CVE-2020-1712) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Package List: Red Hat Enterprise Linux BaseOS E4S (v. 8.0): Source: systemd-239-13.el8_0.7.src.rpm aarch64: systemd-239-13.el8_0.7.aarch64.rpm systemd-container-239-13.el8_0.7.aarch64.rpm systemd-container-debuginfo-239-13.el8_0.7.aarch64.rpm systemd-debuginfo-239-13.el8_0.7.aarch64.rpm systemd-debugsource-239-13.el8_0.7.aarch64.rpm systemd-devel-239-13.el8_0.7.aarch64.rpm systemd-journal-remote-239-13.el8_0.7.aarch64.rpm systemd-journal-remote-debuginfo-239-13.el8_0.7.aarch64.rpm systemd-libs-239-13.el8_0.7.aarch64.rpm systemd-libs-debuginfo-239-13.el8_0.7.aarch64.rpm systemd-pam-239-13.el8_0.7.aarch64.rpm systemd-pam-debuginfo-239-13.el8_0.7.aarch64.rpm systemd-tests-239-13.el8_0.7.aarch64.rpm systemd-tests-debuginfo-239-13.el8_0.7.aarch64.rpm systemd-udev-239-13.el8_0.7.aarch64.rpm systemd-udev-debuginfo-239-13.el8_0.7.aarch64.rpm ppc64le: systemd-239-13.el8_0.7.ppc64le.rpm systemd-container-239-13.el8_0.7.ppc64le.rpm systemd-container-debuginfo-239-13.el8_0.7.ppc64le.rpm systemd-debuginfo-239-13.el8_0.7.ppc64le.rpm systemd-debugsource-239-13.el8_0.7.ppc64le.rpm systemd-devel-239-13.el8_0.7.ppc64le.rpm systemd-journal-remote-239-13.el8_0.7.ppc64le.rpm systemd-journal-remote-debuginfo-239-13.el8_0.7.ppc64le.rpm systemd-libs-239-13.el8_0.7.ppc64le.rpm systemd-libs-debuginfo-239-13.el8_0.7.ppc64le.rpm systemd-pam-239-13.el8_0.7.ppc64le.rpm systemd-pam-debuginfo-239-13.el8_0.7.ppc64le.rpm systemd-tests-239-13.el8_0.7.ppc64le.rpm systemd-tests-debuginfo-239-13.el8_0.7.ppc64le.rpm systemd-udev-239-13.el8_0.7.ppc64le.rpm systemd-udev-debuginfo-239-13.el8_0.7.ppc64le.rpm s390x: systemd-239-13.el8_0.7.s390x.rpm systemd-container-239-13.el8_0.7.s390x.rpm systemd-container-debuginfo-239-13.el8_0.7.s390x.rpm systemd-debuginfo-239-13.el8_0.7.s390x.rpm systemd-debugsource-239-13.el8_0.7.s390x.rpm systemd-devel-239-13.el8_0.7.s390x.rpm systemd-journal-remote-239-13.el8_0.7.s390x.rpm systemd-journal-remote-debuginfo-239-13.el8_0.7.s390x.rpm systemd-libs-239-13.el8_0.7.s390x.rpm systemd-libs-debuginfo-239-13.el8_0.7.s390x.rpm systemd-pam-239-13.el8_0.7.s390x.rpm systemd-pam-debuginfo-239-13.el8_0.7.s390x.rpm systemd-tests-239-13.el8_0.7.s390x.rpm systemd-tests-debuginfo-239-13.el8_0.7.s390x.rpm systemd-udev-239-13.el8_0.7.s390x.rpm systemd-udev-debuginfo-239-13.el8_0.7.s390x.rpm x86_64: systemd-239-13.el8_0.7.i686.rpm systemd-239-13.el8_0.7.x86_64.rpm systemd-container-239-13.el8_0.7.i686.rpm systemd-container-239-13.el8_0.7.x86_64.rpm systemd-container-debuginfo-239-13.el8_0.7.i686.rpm systemd-container-debuginfo-239-13.el8_0.7.x86_64.rpm systemd-debuginfo-239-13.el8_0.7.i686.rpm systemd-debuginfo-239-13.el8_0.7.x86_64.rpm systemd-debugsource-239-13.el8_0.7.i686.rpm systemd-debugsource-239-13.el8_0.7.x86_64.rpm systemd-devel-239-13.el8_0.7.i686.rpm systemd-devel-239-13.el8_0.7.x86_64.rpm systemd-journal-remote-239-13.el8_0.7.x86_64.rpm systemd-journal-remote-debuginfo-239-13.el8_0.7.i686.rpm systemd-journal-remote-debuginfo-239-13.el8_0.7.x86_64.rpm systemd-libs-239-13.el8_0.7.i686.rpm systemd-libs-239-13.el8_0.7.x86_64.rpm systemd-libs-debuginfo-239-13.el8_0.7.i686.rpm systemd-libs-debuginfo-239-13.el8_0.7.x86_64.rpm systemd-pam-239-13.el8_0.7.x86_64.rpm systemd-pam-debuginfo-239-13.el8_0.7.i686.rpm systemd-pam-debuginfo-239-13.el8_0.7.x86_64.rpm systemd-tests-239-13.el8_0.7.x86_64.rpm systemd-tests-debuginfo-239-13.el8_0.7.i686.rpm systemd-tests-debuginfo-239-13.el8_0.7.x86_64.rpm systemd-udev-239-13.el8_0.7.x86_64.rpm systemd-udev-debuginfo-239-13.el8_0.7.i686.rpm systemd-udev-debuginfo-239-13.el8_0.7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-1712 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXk8DR9zjgjWX9erEAQgBCg//bdjwG4MYbuUKH41pwWeyyVXLClAEkUTT irLt1PiN07Ij5q0Gd9UTrd0SAsmUZTWpgSfPktIHldaWmTSfUPAX6v7ls2Rsivqr ut7n34YIP5DFKk6UKVl6HBGv8O+H/4Now/2NyizaNVjM0FI8vE27OlObfE7Y2UX6 BUPtRK/4rEl2pqEthSI1Kj/PRgc2B+nfvXbhK2BrRqG8WW0CUeDBC1I1GvpJbQEG D/IVBt5GKFdAN+f2MvN4aldShOej31BbUGrewISOsfd61epJl4QTGHMKqt0e58q2 axRrPcigMj5tKDa6Dr55ubs1xDQ2sAk/3wyy+RLhQEexWTZJUc19O+nvM8/stfFd 0DlYxg7j8p0BKODcab733VcveoRZj+AQp87umHjvvoTHR9eaCECCXqyHGOF9Tgfy X2PhZniainF2qMH9jlEQeF3n1EwRw0aaFhrEX49OOMufeGHHBCz3yAyAlvb73qcT gfFiZb3Y2X3FbnRZTwv8bSXy9/tp1LA9QWfrX/hNpHYnPNcsJAdrLxOAjdLXL7sd XLIPPQ3kydDRjZ1S4tUzJgRwiq4T6gR4HMF6lHF0s9HIp9l6R3PoQpfPZiK1Ffsf HSzoC6UXy+fI9OesRyKQuCOErujb9ZBpNIcZkxjXLt6vUAh75peSOd9vnzullSAl QZ/iez2MHuc=dZRW -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Security Fix(es): * golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic (CVE-2020-9283) * SSL/TLS: CBC padding timing attack (lucky-13) (CVE-2013-0169) * grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen (CVE-2018-18624) * js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection (CVE-2019-11358) * npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions (CVE-2019-16769) * kibana: Prototype pollution in TSVB could result in arbitrary code execution (ESA-2020-06) (CVE-2020-7013) * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598) * npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7662) * nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203) * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022) * jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023) * grafana: stored XSS (CVE-2020-11110) * grafana: XSS annotation popup vulnerability (CVE-2020-12052) * grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245) * nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures (CVE-2020-13822) * golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040) * nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366) * openshift/console: text injection on error page via crafted url (CVE-2020-10715) * kibana: X-Frame-Option not set by default might lead to clickjacking (CVE-2020-10743) * openshift: restricted SCC allows pods to craft custom network packets (CVE-2020-14336) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution: For OpenShift Container Platform 4.6 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-rel ease-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.6/updating/updating-cluster - -cli.html. Bugs fixed (https://bugzilla.redhat.com/): 907589 - CVE-2013-0169 SSL/TLS: CBC padding timing attack (lucky-13) 1701972 - CVE-2019-11358 jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection 1767665 - CVE-2020-10715 openshift/console: text injection on error page via crafted url 1804533 - CVE-2020-9283 golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic 1813344 - CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload 1828406 - CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method 1834550 - CVE-2020-10743 kibana: X-Frame-Option not set by default might lead to clickjacking 1845982 - CVE-2020-7662 npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser 1848089 - CVE-2020-12052 grafana: XSS annotation popup vulnerability 1848092 - CVE-2019-16769 npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions 1848643 - CVE-2020-12245 grafana: XSS via column.title or cellLinkTooltip 1848647 - CVE-2020-13822 nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures 1849044 - CVE-2020-7013 kibana: Prototype pollution in TSVB could result in arbitrary code execution (ESA-2020-06) 1850004 - CVE-2020-11023 jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution 1850572 - CVE-2018-18624 grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen 1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash 1857412 - CVE-2020-8203 nodejs-lodash: prototype pollution in zipObjectDeep function 1857977 - CVE-2020-15366 nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function 1858981 - CVE-2020-14336 openshift: restricted SCC allows pods to craft custom network packets 1861044 - CVE-2020-11110 grafana: stored XSS 1874671 - CVE-2020-14336 ose-machine-config-operator-container: openshift: restricted SCC allows pods to craft custom network packets [openshift-4] 5. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202003-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: systemd: Heap use-after-free Date: March 15, 2020 Bugs: #708806 ID: 202003-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A heap use-after-free flaw in systemd at worst might allow an attacker to execute arbitrary code. Background ========== A system and service manager. Workaround ========== There is no known workaround at this time. Resolution ========== All systemd users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/systemd-244.3" References ========== [ 1 ] CVE-2020-1712 https://nvd.nist.gov/vuln/detail/CVE-2020-1712 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202003-20 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2020 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . Description: Red Hat CodeReady Workspaces 2.1.0 provides a cloud developer-workspace server and a browser-based IDE built for teams and organizations. CodeReady Workspaces runs in OpenShift and is well-suited for container-based development. Solution: To start using CodeReady Workspaces, download and install it using the instructions provided in the Red Hat CodeReady Workspaces Installation Guide linked from the References section. Bugs fixed (https://bugzilla.redhat.com/): 1816789 - CVE-2020-10689 che: pods in kubernetes cluster can bypass JWT proxy and send unauthenticated requests to workspace pods 5. JIRA issues fixed (https://issues.jboss.org/): CRW-402 - CRW 2.1 devfiles CRW-507 - CRW 2.1 Overall Epic CRW-510 - When not using TLS, Openshift plugin does not allow login via UI (but does work via console login) CRW-533 - Factory are never redirecting to the IDE once loaded CRW-535 - update factories link in CRW dashboard to point to updated user doc CRW-537 - Patches in che-theia repo for theia are not applied in crw-theia build CRW-544 - CRW 2.1 plugins+images CRW-572 - Node 10 example results in "Error: Cannot find module 'express'" CRW-573 - CRW 2.0.x branding update CRW-574 - Cannot inject a devfile or plugin at runtime (container doesn't include yq or build scripts) CRW-784 - Tag not replaced by digest in the `latest` version of plugins in the registry 6. ========================================================================== Ubuntu Security Notice USN-4269-1 February 05, 2020 systemd vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 19.10 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in systemd. A local attacker could possibly use this issue to trick systemd into killing privileged processes. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-16888) It was discovered that systemd incorrectly handled certain udevadm trigger commands. A local attacker could possibly use this issue to cause systemd to consume resources, leading to a denial of service. (CVE-2019-20386) Jann Horn discovered that systemd incorrectly handled services that use the DynamicUser property. A local attacker could possibly use this issue to access resources owned by a different service in the future. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-1712) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 19.10: systemd 242-7ubuntu3.6 Ubuntu 18.04 LTS: systemd 237-3ubuntu10.38 Ubuntu 16.04 LTS: systemd 229-4ubuntu21.27 After a standard system update you need to reboot your computer to make all the necessary changes

In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely. ksh There is an injection vulnerability in.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. 8.0) - aarch64, ppc64le, s390x, x86_64 3. 7) - aarch64, ppc64le, s390x 3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: ksh security update Advisory ID: RHSA-2020:0515-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:0515 Issue date: 2020-02-17 CVE Names: CVE-2019-14868 ===================================================================== 1. Summary: An update for ksh is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: KornShell (ksh) is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell (sh) and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard (IEEE Std 1003.2-1992). Security Fix(es): * ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code injection (CVE-2019-14868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: ksh-20120801-38.el6_10.src.rpm i386: ksh-20120801-38.el6_10.i686.rpm ksh-debuginfo-20120801-38.el6_10.i686.rpm x86_64: ksh-20120801-38.el6_10.x86_64.rpm ksh-debuginfo-20120801-38.el6_10.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: ksh-20120801-38.el6_10.src.rpm x86_64: ksh-20120801-38.el6_10.x86_64.rpm ksh-debuginfo-20120801-38.el6_10.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: ksh-20120801-38.el6_10.src.rpm i386: ksh-20120801-38.el6_10.i686.rpm ksh-debuginfo-20120801-38.el6_10.i686.rpm ppc64: ksh-20120801-38.el6_10.ppc64.rpm ksh-debuginfo-20120801-38.el6_10.ppc64.rpm s390x: ksh-20120801-38.el6_10.s390x.rpm ksh-debuginfo-20120801-38.el6_10.s390x.rpm x86_64: ksh-20120801-38.el6_10.x86_64.rpm ksh-debuginfo-20120801-38.el6_10.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: ksh-20120801-38.el6_10.src.rpm i386: ksh-20120801-38.el6_10.i686.rpm ksh-debuginfo-20120801-38.el6_10.i686.rpm x86_64: ksh-20120801-38.el6_10.x86_64.rpm ksh-debuginfo-20120801-38.el6_10.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-14868 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXkpR39zjgjWX9erEAQgOuA//VVykbqa3Z1flEfzz4+aWXxhfmuF3sEn/ RPoENKb82LLn2BYPkke06fzpU0GynEwgq3AsqezB0GhcU30ErhaEMKb7UggFgjNL /6rbQu/3I9wEbZ9BsiYieuhNY/B77RuaOWYt96M9xthj8naEW4IEf7614ayiFBgu Kcm0g1/4SLiU6jayisb7dlO1yjDSdlM5NUDsYeZu4axMmkGzsxoA1uC8SNe7exee RV03H0TGeg4nXdSrGu6dhpbt8MAT7KM7wtIVpfSzqmepyhCeuqi5yitUeVFtWr3M rcgNRSgG0/IqZJTuccqtpVBWncQisewSfr/AUPpo6LSQOF4UI+PlH0iVJQsitVHi CIjBvlY/AAN2t3efd80nC9sOIOT0AnEyI1NkfRgdybsivarwkT9VYjkdKah7lBQC QBNPXB8elyxjtoB1suhlQPqmSkd4VQ/AP0P2AeB+01fBzV4I1rS+sgcDmiWyOyl4 Xqc4G8Q3eX+Z2N3kGaWtlW92rRF1hhvDeT3VOdHnRD9dofuYQAEVnJGgUOpWQOmA jkMCS4GipUrfyOZVR8iXjYqGoIo4JF2kM5trBYCo5gXW+tiKbZ9dTCQCmqtgVYwK QkH3XQR967JVz1uK1sDB0Ngd5HPqFlvZg+vGcl/xJPr3s8elpOM6AI6vJRgFAArd 1EP8ndPtKmA= =UPpY -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 7) - x86_64 3

TP-Link Archer VR300 is a modem router of China TP-Link company. There is a cross-site scripting vulnerability in TP-Link Archer VR300. Attackers can use this vulnerability to obtain cookies or redirect to malicious websites.

A vulnerability in the Cisco Discovery Protocol implementation for the Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP Camera. The vulnerability is due to missing checks when processing Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to the targeted IP Camera. A successful exploit could allow the attacker to expose the affected IP Camera for remote code execution or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). This vulnerability is fixed in Video Surveillance 8000 Series IP Camera Firmware Release 1.0.7 and later. (DoS) It may be put into a state

A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated, adjacent attacker to remotely execute code with root privileges or cause a reload of an affected IP phone. The vulnerability is due to missing checks when processing Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to the targeted IP phone. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). (DoS) It may be put into a state. Cisco IP Conference Phone 7832 and Cisco IP Conference Phone 8832 are all IP phone series products

HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability. The system has a logic judging error under certain scenario, successful exploit could allow the attacker to switch to third desktop after a series of operation in ADB mode. Huawei Mate 20 is a smartphone from China's Huawei