VARIoT IoT vulnerabilities database

eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the save.cgi script for payload upload and the testtcl.cgi script for its execution. eQ-3 Homematic CCU2 , CCU3 , E-Mail Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Both eQ-3 Homematic CCU3 and eQ-3 Homematic CCU2 are central control units of a smart home system produced by German eQ-3 company. There are security vulnerabilities in E-Mail AddOn 1.6.8.c and earlier versions in eQ-3 Homematic CCU2 version 2.47.20 and CCU3 version 3.47.18. An attacker could exploit this vulnerability to execute code

The Xiaomi Cepheus Android device with a build fingerprint of Xiaomi/cepheus/cepheus:9/PKQ1.181121.001/V10.2.6.0.PFAMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage. Xiaomi Cepheus Android The device is vulnerable to an externally controllable reference to another realm resource.Information may be obtained. Xiaomi Cepheus is a smartphone from China Xiaomi Technology. The access control error vulnerability exists in the com.qualcomm.qti.callenhancement app in Xiaomi Cepheus (build fingerprint: Xiaomi/cepheus/cepheus:9/PKQ1.181121.001/V10.2.6.0.PFAMIXM:user/release-keys). An attacker could use the vulnerability to make unauthorized microphone recordings with third-party software

The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.11). This app contains an exported service named com.lovelyfont.manager.service.FunctionService that allows any app co-located on the device to supply the file path to a Dalvik Executable (DEX) file which it will dynamically load within its own process and execute in with its own system privileges. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing code as the system user can allow a third-party app to factory reset the device, obtain the user's Wi-Fi passwords, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more. Tecno Camon iAir 2 Plus Android Devices are vulnerable to improper assignment of permissions to critical resources.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state

On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. The only requirement is that the attacker have network access to the bulb

The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. The component is: inc/cleantalk-users.php and inc/cleantalk-comments.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL. WordPress is a blogging platform developed by the WordPress Foundation using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. CleanTalk cleantalk-spam-protect is a spam protection plugin used in it. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 (All firmware versions < V6.00.320), Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U with Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 (All firmware versions < V6.00.320), Desigo PX automation controllers PXC22.1-E.D, PXC36-E.D, PXC36.1-E.D with activated web server (All firmware versions < V6.00.320). The device contains a vulnerability that could allow an attacker to cause a denial of service condition on the device's web server by sending a specially crafted HTTP message to the web server port (tcp/80). The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device's web service. While the device itself stays operational, the web server responds with HTTP status code 404 (Not found) to any further request. A reboot is required to recover the web interface. At the time of advisory publication no public exploitation of this security vulnerability was known. Several Siemens products are vulnerable to a resource leak into the wrong area.Service operation interruption (DoS) There is a possibility of being put into a state. The Desigo-PX automation station and operator unit control and monitor the building automation system. They allow alarm signals, time-based programs and trend recording. Desigo PX is a modern building automation and controlsystem for the entire field of building service plants

Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg_24Mhw3. TRENDnet TEW-691GR and TEW-692GR Contains an authentication vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state

Some Huawei home routers have an improper authorization vulnerability. Due to improper authorization of certain programs, an attacker can exploit this vulnerability to execute uploaded malicious files and escalate privilege. plural Huawei home The router contains an incorrect authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Huawei HiRouter-CD15-10 is a wireless router from China's Huawei

Symlink Traversal vulnerability in ASUS RT-AC66U and RT-N56U due to misconfiguration in the SMB service. ASUS RT-AC66U and RT-N56U Contains a path traversal vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state

There is an improper access control vulnerability in Huawei Share. The software does not properly restrict access to certain file from certain application. An attacker tricks the user into installing a malicious application then establishing a connect to the attacker through Huawei Share, successful exploit could cause information disclosure. Huawei Share Contains an information disclosure vulnerability.Information may be obtained. Huawei P20 is a smartphone from China's Huawei company

Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter. Parallels Plesk Panel Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Attackers can use the "fileName" parameter to use the vulnerability to inject JavaScript

The Huawei Share function of P20 phones with versions earlier than Emily-L29C 9.1.0.311 has an improper file management vulnerability. The attacker tricks the victim to perform certain operations on the mobile phone during file transfer. Because the file is not properly processed, successfully exploit may cause some files on the victim's mobile phone are deleted. P20 Smartphones contain a vulnerability related to input confirmation.Information may be tampered with. Huawei P20 is a smartphone from China's Huawei company

Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages. The vulnerability stems from the lack of authentication measures or insufficient authentication strength in network systems or products. No detailed vulnerability details are currently available

Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability by sending special constructed packets to obtain files in the device and upload files to some directories. The Huawei HiRouter-CD15-10 is a wireless router from China's Huawei

Unhandled exception in firmware for Intel(R) Ethernet 700 Series Controllers before version 7.0 may allow an authenticated user to potentially enable a denial of service via local access. Intel(R) Ethernet 700 Series Controller Contains a vulnerability in handling exceptional conditions.Service operation interruption (DoS) There is a possibility of being put into a state. Intel Ethernet 700 Series Controllers is a network adapter product from Intel Corporation. An attacker could exploit this vulnerability to cause a denial of service

The Device Model in ACRN before 2019w25.5-140000p relies on assert calls in devicemodel/hw/pci/core.c and devicemodel/include/pci_core.h (instead of other mechanisms for propagating error information or diagnostic information), which might allow attackers to cause a denial of service (assertion failure) within pci core. This is fixed in 1.2. 6199e653418e is a mitigation for pre-1.1 versions, whereas 2b3dedfb9ba1 is a mitigation for 1.1. ACRN Contains a vulnerability with reachable assertions.Service operation interruption (DoS) There is a possibility of being put into a state. ACRN is an open source virtual machine monitor for the Internet of Things. There are security vulnerabilities in the previous version of ACRN 2019w25.5-140000p. An attacker can use this vulnerability to cause a denial of service

All versions up to V2.5.0_EG1T5_TED of ZTE ZXHN H108N product are impacted by an information leak vulnerability. An attacker could exploit the vulnerability to obtain sensitive information and perform unauthorized operations

Undocumented TELNET service in TRENDnet TEW-812DRU when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg_24Mhw3. TRENDnet TEW-812DRU Contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state

Texas Instruments CC256x and WL18xx dual-mode Bluetooth controller devices, when LE scan mode is used, allow remote attackers to trigger a buffer overflow via a malformed Bluetooth Low Energy advertising packet, to cause a denial of service or potentially execute arbitrary code. This affects CC256xC-BT-SP 1.2, CC256xB-BT-SP 1.8, and WL18xx-BT-SP 4.4

Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access. Both Microsoft Windows and Microsoft Windows Server are products of Microsoft Corporation. Microsoft Windows is an operating system for personal devices. Microsoft Windows Server is a server operating system. A denial of service vulnerability exists in Microsoft Windows and Windows Server due to the program's improper handling of objects in memory. An attacker could exploit this vulnerability by logging on to an affected system and running a specially crafted application to cause the targeted system to become unresponsive. The following products and versions are affected: Microsoft Windows 10, Windows 10 Version 1607, Windows 10 Version 1709, Windows 10 Version 1803, Windows 10 Version 1809, Windows 10 Version 1903, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server version 1803, Windows Server version 1903. ========================================================================== Ubuntu Security Notice USN-4184-1 November 13, 2019 linux, linux-aws, linux-azure, linux-gcp, linux-gke-5.0, linux-hwe, linux-kvm, linux-oem-osp1, linux-oracle, linux-raspi2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 19.04 - Ubuntu 18.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-azure: Linux kernel for Microsoft Azure Cloud systems - linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems - linux-kvm: Linux kernel for cloud environments - linux-oracle: Linux kernel for Oracle Cloud systems - linux-raspi2: Linux kernel for Raspberry Pi 2 - linux-gke-5.0: Linux kernel for Google Container Engine (GKE) systems - linux-hwe: Linux hardware enablement (HWE) kernel - linux-oem-osp1: Linux kernel for OEM processors Details: Stephan van Schaik, Alyssa Milburn, Sebastian \xd6sterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida, Giorgi Maisuradze, Moritz Lipp, Michael Schwarz, Daniel Gruss, and Jo Van Bulck discovered that Intel processors using Transactional Synchronization Extensions (TSX) could expose memory contents previously stored in microarchitectural buffers to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2019-11135) It was discovered that the Intel i915 graphics chipsets allowed userspace to modify page table entries via writes to MMIO from the Blitter Command Streamer and expose kernel memory information. A local attacker could use this to expose sensitive information or possibly elevate privileges. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2018-12207) It was discovered that the Intel i915 graphics chipsets could cause a system hang when userspace performed a read from GT memory mapped input output (MMIO) when the product is in certain low power states. A local attacker could use this to cause a denial of service. (CVE-2019-0154) Hui Peng discovered that the Atheros AR6004 USB Wi-Fi device driver for the Linux kernel did not properly validate endpoint descriptors returned by the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15098) Jann Horn discovered a reference count underflow in the shiftfs implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15791) Jann Horn discovered a type confusion vulnerability in the shiftfs implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15792) Jann Horn discovered that the shiftfs implementation in the Linux kernel did not use the correct file system uid/gid when the user namespace of a lower file system is not in the init user namespace. A local attacker could use this to possibly bypass DAC permissions or have some other unspecified impact. (CVE-2019-15793) Ori Nimron discovered that the AX25 network protocol implementation in the Linux kernel did not properly perform permissions checks. A local attacker could use this to create a raw socket. (CVE-2019-17052) Ori Nimron discovered that the IEEE 802.15.4 Low-Rate Wireless network protocol implementation in the Linux kernel did not properly perform permissions checks. A local attacker could use this to create a raw socket. (CVE-2019-17053) Ori Nimron discovered that the Appletalk network protocol implementation in the Linux kernel did not properly perform permissions checks. A local attacker could use this to create a raw socket. (CVE-2019-17054) Ori Nimron discovered that the modular ISDN network protocol implementation in the Linux kernel did not properly perform permissions checks. A local attacker could use this to create a raw socket. (CVE-2019-17055) Ori Nimron discovered that the Near field Communication (NFC) network protocol implementation in the Linux kernel did not properly perform permissions checks. A local attacker could use this to create a raw socket. (CVE-2019-17056) Nico Waisman discovered that a buffer overflow existed in the Realtek Wi-Fi driver for the Linux kernel when handling Notice of Absence frames. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-17666) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 19.04: linux-image-5.0.0-1007-oracle 5.0.0-1007.12 linux-image-5.0.0-1021-aws 5.0.0-1021.24 linux-image-5.0.0-1022-kvm 5.0.0-1022.24 linux-image-5.0.0-1022-raspi2 5.0.0-1022.23 linux-image-5.0.0-1025-azure 5.0.0-1025.27 linux-image-5.0.0-1025-gcp 5.0.0-1025.26 linux-image-5.0.0-35-generic 5.0.0-35.38 linux-image-5.0.0-35-generic-lpae 5.0.0-35.38 linux-image-5.0.0-35-lowlatency 5.0.0-35.38 linux-image-aws 5.0.0.1021.23 linux-image-azure 5.0.0.1025.25 linux-image-gcp 5.0.0.1025.50 linux-image-generic 5.0.0.35.37 linux-image-generic-lpae 5.0.0.35.37 linux-image-gke 5.0.0.1025.50 linux-image-kvm 5.0.0.1022.23 linux-image-lowlatency 5.0.0.35.37 linux-image-oracle 5.0.0.1007.33 linux-image-raspi2 5.0.0.1022.20 linux-image-virtual 5.0.0.35.37 Ubuntu 18.04 LTS: linux-image-5.0.0-1025-azure 5.0.0-1025.27~18.04.1 linux-image-5.0.0-1025-gcp 5.0.0-1025.26~18.04.1 linux-image-5.0.0-1025-gke 5.0.0-1025.26~18.04.1 linux-image-5.0.0-1027-oem-osp1 5.0.0-1027.31 linux-image-5.0.0-35-generic 5.0.0-35.38~18.04.1 linux-image-5.0.0-35-generic-lpae 5.0.0-35.38~18.04.1 linux-image-5.0.0-35-lowlatency 5.0.0-35.38~18.04.1 linux-image-azure 5.0.0.1025.36 linux-image-gcp 5.0.0.1025.29 linux-image-generic-hwe-18.04 5.0.0.35.93 linux-image-generic-lpae-hwe-18.04 5.0.0.35.93 linux-image-gke-5.0 5.0.0.1025.14 linux-image-lowlatency-hwe-18.04 5.0.0.35.93 linux-image-oem-osp1 5.0.0.1027.31 linux-image-snapdragon-hwe-18.04 5.0.0.35.93 linux-image-virtual-hwe-18.04 5.0.0.35.93 Please note that mitigating the TSX (CVE-2019-11135) and i915 (CVE-2019-0154) issues requires corresponding microcode and graphics firmware updates respectively. After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://usn.ubuntu.com/4184-1 CVE-2018-12207, CVE-2019-0154, CVE-2019-0155, CVE-2019-11135, CVE-2019-15098, CVE-2019-15791, CVE-2019-15792, CVE-2019-15793, CVE-2019-17052, CVE-2019-17053, CVE-2019-17054, CVE-2019-17055, CVE-2019-17056, CVE-2019-17666, https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/TAA_MCEPSC_i915 Package Information: https://launchpad.net/ubuntu/+source/linux/5.0.0-35.38 https://launchpad.net/ubuntu/+source/linux-aws/5.0.0-1021.24 https://launchpad.net/ubuntu/+source/linux-azure/5.0.0-1025.27 https://launchpad.net/ubuntu/+source/linux-gcp/5.0.0-1025.26 https://launchpad.net/ubuntu/+source/linux-kvm/5.0.0-1022.24 https://launchpad.net/ubuntu/+source/linux-oracle/5.0.0-1007.12 https://launchpad.net/ubuntu/+source/linux-raspi2/5.0.0-1022.23 https://launchpad.net/ubuntu/+source/linux-azure/5.0.0-1025.27~18.04.1 https://launchpad.net/ubuntu/+source/linux-gcp/5.0.0-1025.26~18.04.1 https://launchpad.net/ubuntu/+source/linux-gke-5.0/5.0.0-1025.26~18.04.1 https://launchpad.net/ubuntu/+source/linux-hwe/5.0.0-35.38~18.04.1 https://launchpad.net/ubuntu/+source/linux-oem-osp1/5.0.0-1027.31 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2019:3836-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:3836 Issue date: 2019-11-12 CVE Names: CVE-2018-12207 CVE-2019-0154 CVE-2019-3900 CVE-2019-11135 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - noarch, x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * hw: Machine Check Error on Page Size Change (IFU) (CVE-2018-12207) * hw: TSX Transaction Asynchronous Abort (TAA) (CVE-2019-11135) * Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900) * hw: Intel GPU Denial Of Service while accessing MMIO in lower power state (CVE-2019-0154) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * [Intel 6.10 Bug] With mWait/C-states disabled, HT on, ibrs enabled, performance impact observed on user space benchmark (BZ#1560787) * kernel-2.6.32-573.60.2.el6 hangs/resets during boot in efi_enter_virtual_mode() on Xeon v2 E7-2870 (BZ#1645724) * Slab leak: skbuff_head_cache slab object still allocated after mcast processes are stopped and "fragments dropped after timeout" errors are shown (BZ#1752536) 4. 5. Bugs fixed (https://bugzilla.redhat.com/): 1646768 - CVE-2018-12207 hw: Machine Check Error on Page Size Change (IPU) 1698757 - CVE-2019-3900 Kernel: vhost_net: infinite loop while receiving packets leads to DoS 1724393 - CVE-2019-0154 hw: Intel GPU Denial Of Service while accessing MMIO in lower power state 1753062 - CVE-2019-11135 hw: TSX Transaction Asynchronous Abort (TAA) 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: kernel-2.6.32-754.24.2.el6.src.rpm i386: kernel-2.6.32-754.24.2.el6.i686.rpm kernel-debug-2.6.32-754.24.2.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debug-devel-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.24.2.el6.i686.rpm kernel-devel-2.6.32-754.24.2.el6.i686.rpm kernel-headers-2.6.32-754.24.2.el6.i686.rpm perf-2.6.32-754.24.2.el6.i686.rpm perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-754.24.2.el6.noarch.rpm kernel-doc-2.6.32-754.24.2.el6.noarch.rpm kernel-firmware-2.6.32-754.24.2.el6.noarch.rpm x86_64: kernel-2.6.32-754.24.2.el6.x86_64.rpm kernel-debug-2.6.32-754.24.2.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.24.2.el6.i686.rpm kernel-debug-devel-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.24.2.el6.x86_64.rpm kernel-devel-2.6.32-754.24.2.el6.x86_64.rpm kernel-headers-2.6.32-754.24.2.el6.x86_64.rpm perf-2.6.32-754.24.2.el6.x86_64.rpm perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.24.2.el6.i686.rpm perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm python-perf-2.6.32-754.24.2.el6.i686.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm x86_64: kernel-debug-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.24.2.el6.x86_64.rpm perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm python-perf-2.6.32-754.24.2.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: kernel-2.6.32-754.24.2.el6.src.rpm noarch: kernel-abi-whitelists-2.6.32-754.24.2.el6.noarch.rpm kernel-doc-2.6.32-754.24.2.el6.noarch.rpm kernel-firmware-2.6.32-754.24.2.el6.noarch.rpm x86_64: kernel-2.6.32-754.24.2.el6.x86_64.rpm kernel-debug-2.6.32-754.24.2.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.24.2.el6.i686.rpm kernel-debug-devel-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.24.2.el6.x86_64.rpm kernel-devel-2.6.32-754.24.2.el6.x86_64.rpm kernel-headers-2.6.32-754.24.2.el6.x86_64.rpm perf-2.6.32-754.24.2.el6.x86_64.rpm perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): x86_64: kernel-debug-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.24.2.el6.x86_64.rpm perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm python-perf-2.6.32-754.24.2.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: kernel-2.6.32-754.24.2.el6.src.rpm i386: kernel-2.6.32-754.24.2.el6.i686.rpm kernel-debug-2.6.32-754.24.2.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debug-devel-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.24.2.el6.i686.rpm kernel-devel-2.6.32-754.24.2.el6.i686.rpm kernel-headers-2.6.32-754.24.2.el6.i686.rpm perf-2.6.32-754.24.2.el6.i686.rpm perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-754.24.2.el6.noarch.rpm kernel-doc-2.6.32-754.24.2.el6.noarch.rpm kernel-firmware-2.6.32-754.24.2.el6.noarch.rpm ppc64: kernel-2.6.32-754.24.2.el6.ppc64.rpm kernel-bootwrapper-2.6.32-754.24.2.el6.ppc64.rpm kernel-debug-2.6.32-754.24.2.el6.ppc64.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.ppc64.rpm kernel-debug-devel-2.6.32-754.24.2.el6.ppc64.rpm kernel-debuginfo-2.6.32-754.24.2.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-754.24.2.el6.ppc64.rpm kernel-devel-2.6.32-754.24.2.el6.ppc64.rpm kernel-headers-2.6.32-754.24.2.el6.ppc64.rpm perf-2.6.32-754.24.2.el6.ppc64.rpm perf-debuginfo-2.6.32-754.24.2.el6.ppc64.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.ppc64.rpm s390x: kernel-2.6.32-754.24.2.el6.s390x.rpm kernel-debug-2.6.32-754.24.2.el6.s390x.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.s390x.rpm kernel-debug-devel-2.6.32-754.24.2.el6.s390x.rpm kernel-debuginfo-2.6.32-754.24.2.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-754.24.2.el6.s390x.rpm kernel-devel-2.6.32-754.24.2.el6.s390x.rpm kernel-headers-2.6.32-754.24.2.el6.s390x.rpm kernel-kdump-2.6.32-754.24.2.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-754.24.2.el6.s390x.rpm kernel-kdump-devel-2.6.32-754.24.2.el6.s390x.rpm perf-2.6.32-754.24.2.el6.s390x.rpm perf-debuginfo-2.6.32-754.24.2.el6.s390x.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.s390x.rpm x86_64: kernel-2.6.32-754.24.2.el6.x86_64.rpm kernel-debug-2.6.32-754.24.2.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.24.2.el6.i686.rpm kernel-debug-devel-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.24.2.el6.x86_64.rpm kernel-devel-2.6.32-754.24.2.el6.x86_64.rpm kernel-headers-2.6.32-754.24.2.el6.x86_64.rpm perf-2.6.32-754.24.2.el6.x86_64.rpm perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.24.2.el6.i686.rpm perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm python-perf-2.6.32-754.24.2.el6.i686.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm ppc64: kernel-debug-debuginfo-2.6.32-754.24.2.el6.ppc64.rpm kernel-debuginfo-2.6.32-754.24.2.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-754.24.2.el6.ppc64.rpm perf-debuginfo-2.6.32-754.24.2.el6.ppc64.rpm python-perf-2.6.32-754.24.2.el6.ppc64.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.ppc64.rpm s390x: kernel-debug-debuginfo-2.6.32-754.24.2.el6.s390x.rpm kernel-debuginfo-2.6.32-754.24.2.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-754.24.2.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-754.24.2.el6.s390x.rpm perf-debuginfo-2.6.32-754.24.2.el6.s390x.rpm python-perf-2.6.32-754.24.2.el6.s390x.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.s390x.rpm x86_64: kernel-debug-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.24.2.el6.x86_64.rpm perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm python-perf-2.6.32-754.24.2.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: kernel-2.6.32-754.24.2.el6.src.rpm i386: kernel-2.6.32-754.24.2.el6.i686.rpm kernel-debug-2.6.32-754.24.2.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debug-devel-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.24.2.el6.i686.rpm kernel-devel-2.6.32-754.24.2.el6.i686.rpm kernel-headers-2.6.32-754.24.2.el6.i686.rpm perf-2.6.32-754.24.2.el6.i686.rpm perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-754.24.2.el6.noarch.rpm kernel-doc-2.6.32-754.24.2.el6.noarch.rpm kernel-firmware-2.6.32-754.24.2.el6.noarch.rpm x86_64: kernel-2.6.32-754.24.2.el6.x86_64.rpm kernel-debug-2.6.32-754.24.2.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.24.2.el6.i686.rpm kernel-debug-devel-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.24.2.el6.x86_64.rpm kernel-devel-2.6.32-754.24.2.el6.x86_64.rpm kernel-headers-2.6.32-754.24.2.el6.x86_64.rpm perf-2.6.32-754.24.2.el6.x86_64.rpm perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-2.6.32-754.24.2.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.24.2.el6.i686.rpm perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm python-perf-2.6.32-754.24.2.el6.i686.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.i686.rpm x86_64: kernel-debug-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.24.2.el6.x86_64.rpm perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm python-perf-2.6.32-754.24.2.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.24.2.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXcsc39zjgjWX9erEAQiIXQ//fbQ5UKtMa2pfofnF6CbwO4DbAYnOWbqx 1n4xgcWLZljSYz0/jp7h+fcDcF0TaQYswGhNj/oCvpGUl5NOZMhbAwVy/+hzzHiP gqRzyZSgIFpM1fUu+AtjGInWVS37eDGGqxQqsBGNh30l4/x4DduCdmN7XDXrKxgz 1TVUlsS34AHHmhk3brFeaf/bPY2jIGH9oZfC3wiX3L8sczjmSOlCC3E1sI3pm/uo Vin3Sl4vz9+krNNwxZw/6WE4wXMslaRBYku6cW31RgdmrZXXJGqYt5hglMbckSwn +x8SrFcRJkbgQiCo27ikf1rnjz/NB2f0E9kIoOVHoKZ/RW/HgFVlgC5LSZqrsVtE ARRhaT4dHDRZWxMwFaf6NNo6CpigxXC2fh7+9KXylUAq7HAT03wCBf1KWMgCzbG9 RlWSLQc5z8pwWPvnN1vsL5ZyaAXUDGjjU0ebSgcxvRRmGVt+YKtiGJU58lR6RuZt up6aUM1QoXNCKiLB+497ZNwANj0G3oBRA2qEAstffJksMrEBD3X15rIE4m5vxGpS ZMqKmT72HuG6MjOOwPZq6qwN0fOwpoAPnpIvHtl0NXJHtu1AmJgXcfERkNlN9X8d u+Mgr+sYxDjAlysz0qOwvD0Ib9SRFgwGQgo+B6Wvi6iG17yh9B/cunAYUQ0wDm3U XkMJCJGhDCY= =fpzb -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 7) - noarch, x86_64 3. Description: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Description: This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. 6.6) - x86_64 3. Due to the high complexity of the fixes and the required microcode update, we are unable to livepatch this set of CVEs. Please plan to reboot into an updated kernel as soon as possible. The details of these CVEs follows: CVE-2018-12207 On an Ubuntu KVM host configured to use huge pages, a malicious KVM guest can cause a host machine check exception (MCE) capable of bringing down the host OS. CVE-2019-11135 On Intel processors with support for Transactional Synchronization Extensions (TSX), it is possible to exploit a transactional asynchronous abort (TAA) to perform a side-channel attack and leak kernel memory. Further details on the vulnerabilities and our response can be found here: https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/TAA_MCEPSC_i915 Again, due to the high complexity of the fixes and the required microcode update, we are unable to livepatch this set of CVEs. Please plan to reboot into an updated kernel as soon as possible. | Series | Version | Flavors | |------------------+-----------------------+--------------------------| | Ubuntu 18.04 LTS | 4.15.0-1054.55 | aws | | Ubuntu 16.04 LTS | 4.4.0-1098.102 | aws | | Ubuntu 18.04 LTS | 5.0.0-1025.27~18.04.1 | azure | | Ubuntu 16.04 LTS | 4.15.0-1063.66 | azure | | Ubuntu 18.04 LTS | 4.15.0-69.78 | generic lowlatency | | Ubuntu 16.04 LTS | 4.15.0-69.78~16.04.1 | generic lowlatency | | Ubuntu 14.04 LTS | 4.4.0-168.197~14.04.1 | generic lowlatency | | Ubuntu 18.04 LTS | 4.15.0-1063.72 | oem | | Ubuntu 16.04 LTS | 4.4.0-168.197 | generic lowlatency | Support Information: Kernels older than the levels listed above will no longer receive livepatch updates. References: CVE-2018-12207, CVE-2019-0154, CVE-2019-0155, CVE-2019-11135 -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce . In addition this update provides mitigations for the "TSX Asynchronous Abort" speculative side channel attack. For additional information please refer to https://xenbits.xen.org/xsa/advisory-305.html For the oldstable distribution (stretch), these problems have been fixed in version 4.8.5.final+shim4.10.4-1+deb9u12. Note that this will be the last security update for Xen in the oldstable distribution; upstream support for the 4.8.x branch ended by the end of December 2019. If you rely on security support for your Xen installation an update to the stable distribution (buster) is recommended. For the stable distribution (buster), these problems have been fixed in version 4.11.3+24-g14b62ab3e5-1~deb10u1. We recommend that you upgrade your xen packages. For the detailed security status of xen please refer to its security tracker page at: https://security-tracker.debian.org/tracker/xen Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl4c7kEACgkQEMKTtsN8 TjYTuQ//R8WXtoC9qnD7wrV1E9skzu0YgXXUJDgaY6V2cTxRZ9n+RC7szVBXqfjJ OzOhNDESTG1aeOg/vnwHgDLMigIe5HlNSYPMXFk9IqOtsRTaP+Ddp1e/msfudYqP rOiI+NzRk2MnFwT348SCuJK7tS/6coj2IECaYc+LOMp05eg+y4r+KLc6FFWm/UEB 9M0SQMv6vMHaSCqJ7OlzE9j1pta3qPHp6vDpDQC0ngjvTJI85Z6l1p2dJ600bcZR Am4nl/1va8Mxc6hFYQ0h8TV2leELsw3B4f5f4LPKh5U7ZiHM5DfWGZLKxf/SJRpf brt0wwYABM0qMqqelrEZOHWqdFg17ozYkNhuUYYLS3P/AWiOZURHq/xszsv98dGh EUzMPL/P0mHyxrOlG8BrhaZ0O2FfAABRdfNDEO4pDGQSFYYpniOW9a+6yZsmKJDg njryOlSwXa/yrqde5JSqDlJFtwnRZu5IhdeCERXfczpauBrqOzUCUX1n72JSrtlD TUeMMj3QBbuLtJhFbQZH+/dqbQlYKu0u7VPA5fP+7nxsG+9NqwRHv6J2lh0YKXYz ej2WFpM+oBpr12dtFx2buZVzZofHGZd5y1kjGq0yRwnBSrdSKYC5dhtX32weHfSL jnN2rWTafoKwSOJvvofoMjmjcYwTfBzorTO1EX01FPxZqy/nrsA=3Qmh -----END PGP SIGNATURE----- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202003-56 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Xen: Multiple vulnerabilities Date: March 25, 2020 Bugs: #686024, #699048, #699996, #702644 ID: 202003-56 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Xen, the worst of which could allow for privilege escalation. Background ========== Xen is a bare-metal hypervisor. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-emulation/xen < 4.12.0-r1 >= 4.12.0-r1 2 app-emulation/xen-tools < 4.12.0-r1 >= 4.12.0-r1 ------------------------------------------------------------------- 2 affected packages Description =========== Multiple vulnerabilities have been discovered in Xen. Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Xen users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.12.0-r1" References ========== [ 1 ] CVE-2018-12126 https://nvd.nist.gov/vuln/detail/CVE-2018-12126 [ 2 ] CVE-2018-12127 https://nvd.nist.gov/vuln/detail/CVE-2018-12127 [ 3 ] CVE-2018-12130 https://nvd.nist.gov/vuln/detail/CVE-2018-12130 [ 4 ] CVE-2018-12207 https://nvd.nist.gov/vuln/detail/CVE-2018-12207 [ 5 ] CVE-2018-12207 https://nvd.nist.gov/vuln/detail/CVE-2018-12207 [ 6 ] CVE-2019-11091 https://nvd.nist.gov/vuln/detail/CVE-2019-11091 [ 7 ] CVE-2019-11135 https://nvd.nist.gov/vuln/detail/CVE-2019-11135 [ 8 ] CVE-2019-18420 https://nvd.nist.gov/vuln/detail/CVE-2019-18420 [ 9 ] CVE-2019-18421 https://nvd.nist.gov/vuln/detail/CVE-2019-18421 [ 10 ] CVE-2019-18423 https://nvd.nist.gov/vuln/detail/CVE-2019-18423 [ 11 ] CVE-2019-18424 https://nvd.nist.gov/vuln/detail/CVE-2019-18424 [ 12 ] CVE-2019-18425 https://nvd.nist.gov/vuln/detail/CVE-2019-18425 [ 13 ] CVE-2019-19577 https://nvd.nist.gov/vuln/detail/CVE-2019-19577 [ 14 ] CVE-2019-19578 https://nvd.nist.gov/vuln/detail/CVE-2019-19578 [ 15 ] CVE-2019-19580 https://nvd.nist.gov/vuln/detail/CVE-2019-19580 [ 16 ] CVE-2019-19581 https://nvd.nist.gov/vuln/detail/CVE-2019-19581 [ 17 ] CVE-2019-19582 https://nvd.nist.gov/vuln/detail/CVE-2019-19582 [ 18 ] CVE-2019-19583 https://nvd.nist.gov/vuln/detail/CVE-2019-19583 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202003-56 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2020 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . This update addresses the issue. We apologize for the inconvenience